US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries
ANY.RUN linked 601 RMM-tool phishing cases across 46 countries, with the US the top target at 45% of observed activity.
A phishing campaign that tricks victims into installing legitimate remote monitoring and management (RMM) software spans 46 countries, with around 45% of observed activity targeting the United States, according to ANY.RUN. Lures include Canada Revenue Agency tax forms, UPS shipping notices, Adobe PDF pages, Social Security Administration themes and invoices, delivered through rapidly rotated Vercel, GitHub Pages and Netlify infrastructure. Researchers identified 425 kit URLs across 240 hosts, 94% of which appeared for only a single day, while stable kit indicators such as font1.woff2 and the secure.html to project/*.zip chain tie the infrastructure together.