Email-Delivered RMM: Abusing PDFs for Silent Initial Access

A targeted campaign has been observed since November 2024, primarily affecting organizations in France and Luxembourg. The attackers use socially engineered emails to deliver PDF documents containing embedded links to Remote Monitoring and Management (RMM) tool installers. This method bypasses many email and malware defenses. The PDFs are tailored to the victim's industry and often disguised as invoices, contracts, or property listings. The activity focuses on high-value sectors such as energy, government, banking, and construction. Various RMM tools are used, including FleetDeck, Atera, and Bluetrait. The attackers leverage direct download links and tools that require minimal setup, streamlining the infection process. This approach allows threat actors to gain initial access, disable security features, and potentially deploy subsequent malware using trusted tools.

• Fake Calendly "Meta Careers" pages steal Facebook and Google loginsCampaign2026-10-14
• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMsMalware2026-10-07
• Microsoft Teams to get AI-powered, context-aware phishing detectionNews2026-10-23
• Technology that blocks DGA domains | Kaspersky official blogAnalysis2026-10-23
• 2026 Year End Phishing LuresCampaign2026-10-22