CSuite (Threat actor): news timeline & CVEs

US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access

US-focused CSuite phishing steals Microsoft 365 sessions and installs RMM tools for persistent access.

ANY.RUN researchers tracked a US-focused phishing operation they call CSuite across 351 sandbox analyses, with 51 percent of submissions from the United States and 18 percent from India. Lures impersonate Adobe, DocuSign, Zoom, Google Meet, Dropbox, and Microsoft 365. One path delivers archives or BAT and VBS droppers that install legitimate remote-management tools such as ScreenConnect or Action1; another uses credential harvesting or device-code phishing to steal Microsoft 365 access and active sessions. Technology, manufacturing, government, and consulting organizations were among the most exposed, enabling mailbox fraud and persistent endpoint access.

The Hacker Newsupdated Sep 30, 16:32 UTC · 15h agofirst Sep 30, 10:45 UTC · 21h agoPhishing & fraud in the wild 7 sources3

How US SOCs and MSSPs Can Use Threat Intelligence to Detect Phishing Infrastructure Earlier

ANY.RUN says OAuth device-code phishing jumped 483.7% in H1 2026.

ANY.RUN argues that US SOCs and MSSPs should use threat intelligence to link phishing domains, redirectors, kits, and cloud-hosted stages before a campaign changes URLs. Its H1 2026 report says OAuth device-code phishing surged 483.7% and cloud infrastructure abuse rose 90.7%. The CSuite campaign impersonated Adobe, DocuSign, Zoom, SharePoint, and Microsoft 365, combining phishing, session theft, and legitimate remote-management software, with US organizations 60% of identified victims.

Cyber Security NewsSep 29, 16:06 UTC · 1d agoPhishing & fraud in the wild 2 sources

Major Cyber Attacks in September 2026: US Organizations Face Session Theft, Remote Access, and Payment Fraud

September campaigns CSuite, N0va, and IronToll phished US organizations for Microsoft 365 sessions, tokens, and payment data.

ANY.RUN's September 2026 roundup describes phishing operations against US and European organizations. CSuite combined Microsoft 365 session theft with remote-management tools including ScreenConnect, Action1, Atera, Syncro, and PDQ Connect; 51% of 351 linked sandbox submissions came from the United States. N0va used device-code phishing to steal Microsoft 365 access and refresh tokens through legitimate authentication flows. IronToll, tied to 114 domains across more than 12 countries, used cloned payment pages and a live operator panel to steal card data and one-time passwords.

ANY.RUNupdated Sep 29, 16:06 UTC · 1d agofirst Sep 29, 08:32 UTC · 1d agoPhishing & fraud in the wild 2 sources2

CSuite

Timeline3 articles

Appears with

US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access

How US SOCs and MSSPs Can Use Threat Intelligence to Detect Phishing Infrastructure Earlier

Major Cyber Attacks in September 2026: US Organizations Face Session Theft, Remote Access, and Payment Fraud