CampaignPublished 20 Jun 2025

Cybercriminals Abusing Vercel to Deliver Remote Access Malware

Source AlienVault OTX General

Description

A phishing campaign has been identified that exploits Vercel, a legitimate frontend hosting platform, to distribute a malicious version of LogMeIn. Cybercriminals send phishing emails with links to a malicious page on Vercel, impersonating an Adobe PDF viewer and prompting users to download a disguised executable. Once executed, the malware installs and connects to a LogMeIn server, allowing remote access and control of the compromised machine. Over 28 distinct campaigns targeting more than 1,271 users have been observed in the past two months. The technique's effectiveness stems from the use of a legitimate platform, a genuine remote access tool, and social engineering tactics. Recommendations include monitoring suspicious Vercel subdomains, educating employees about fake support scams, and implementing strict controls for remote access software installations.

Impact

For European organizations, this threat poses a considerable risk to confidentiality, integrity, and availability. Successful compromise allows attackers to remotely control infected machines, potentially leading to data exfiltration, lateral movement within networks, deployment of additional malware, or disruption of business operations. The use of a legitimate platform and software reduces suspicion and increases the likelihood of successful infection, especially in environments with less mature security awareness. Organizations handling sensitive data, intellectual property, or critical infrastructure could face severe operational and reputational damage. The campaign’s scale and persistence indicate a broad targeting approach, which could affect various sectors including finance, manufacturing, and public administration across Europe. The threat also highlights the risk of supply chain and platform abuse, emphasizing the need for vigilance even when interacting with trusted services.

Defensive guidance

1. Implement advanced email filtering and phishing detection solutions that specifically analyze URLs and attachments for signs of platform abuse and masquerading. 2. Monitor DNS and web traffic for suspicious or newly created Vercel subdomains, especially those mimicking legitimate services or software interfaces. 3. Enforce application whitelisting and restrict installation of remote access software to approved and verified tools only. 4. Conduct targeted security awareness training focusing on recognizing fake support scams, phishing emails impersonating common software (e.g., Adobe PDF viewers), and the risks of executing unsolicited downloads. 5. Deploy endpoint detection and response (EDR) solutions capable of identifying unusual LogMeIn connections or unauthorized remote access sessions. 6. Use multi-factor authentication (MFA) for remote access tools and VPNs to reduce the risk of unauthorized access even if credentials are compromised. 7. Regularly audit and update remote access policies, ensuring least privilege principles are applied and remote access is logged and monitored. 8. Collaborate with platform providers like Vercel to report and takedown malicious subdomains promptly. 9. Maintain updated threat intelligence feeds to quickly identify and block known malicious hashes and domains associated with this campaign.

Indicators of compromise

Domains 2

findhome.cl
mail.blta.ro

Hashes 10

322a92b443faefe48fce629e8947e4e2
e230bf859e582fe95df0b203892048df
f3f8379ce6e0b8f80faf259db2443f13
f782c936249b9786cc7fac580da3ae0f
5fd4bcca28553ebe759ec97fcbc3a2a732268f85
6fa2dd3d3f4e486788b5c37abaa8a6a040bbb518
d1392dedfe3dcc1d3d1fb7cb01bf2b006d2804dc
0a1a85a026b6d477f59bc3d965b07d0d06e6ff2d34381aff79ea71c38fed802b
233e1eff3fa01631889529032b15cf7a2d686462e002b9a7b56355f93ab45e52
9bde904a892ebb8db95040cbf793a585704063c7656ece6186486752f68b8a6b

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Jun 2025, 13:09 UTC

MITRE ATT&CK techniques8 from threat tags

Technical details

Indicators of compromise

Domains 2

Hashes 10

Community reviews

Related threats