Sign here… and install an unwanted RMM

This threat involves a sophisticated phishing campaign that impersonates DocuSign to lure victims into downloading malicious MSI installers via fraudulent webpages containing embedded JavaScript droppers. The payloads install legitimate RMM tools from Atera Network Ltd and ConnectWise/ScreenConnect, which attackers abuse to establish remote access on compromised Windows and macOS systems. The attackers operate a large infrastructure with hundreds of domains and use Telegram bots to gather detailed telemetry from victims. The campaign relies on social engineering and abuse of legitimate software rather than exploiting software vulnerabilities.

Victims who fall for the phishing lure may inadvertently install legitimate RMM software controlled by attackers, granting them remote access to the victim's system. This can lead to unauthorized monitoring, data theft, and further compromise. The campaign collects detailed telemetry about victims, potentially aiding targeted follow-up attacks. The use of legitimate RMM tools complicates detection and response.

No official patch or fix is available since this is a social engineering campaign abusing legitimate software. Mitigation focuses on user awareness to recognize phishing attempts impersonating DocuSign, avoiding installation of unsolicited updates or documents, and verifying software sources. Organizations should monitor for unauthorized RMM installations and review endpoint security controls to detect misuse of legitimate management tools.