Threats Tagged 'rmm tools'

A misconfigured Python HTTP server on a Budapest VPS exposed the full operational infrastructure of three distinct AiTM phishing operators: codemado (Egyptian), saroula01, and mail-argenta (Nigerian). The exposed data included phishing configurations, credential logs, remote management tool installers, combolists, and Telegram session files. These operators used customized Evilginx forks and AI-assisted development to build MFA-bypass phishing infrastructure targeting primarily Microsoft 365 accounts. The campaigns were active from at least January 2025 through May 2026 and involved OAuth Device Code Flow attacks and other sophisticated phishing techniques.

MediumMalwareUnited StatesAustraliaBrazil+8#madoo blaster#asyncrat#rmm tools

A sophisticated phishing campaign leverages evolved ClickFix techniques to bypass modern endpoint security through victim-assisted execution. Targets receive emails with urgent OneDrive document lures containing malicious ZIP attachments. The attack uses LNK shortcuts that redirect victims to landing pages, silently injecting PowerShell commands into their clipboard. Through social engineering, victims are tricked into manually executing commands via Win+R, circumventing traditional security filters. The campaign employs DNS TXT records for payload staging, avoiding HTTP detection. The threat infrastructure hosts multiple malicious components including obfuscated scripts, fake MSI installers masquerading as legitimate software like ConnectWise, and ISO images with spyware for persistent access. This represents a shift toward long-game tactics focused on establishing full post-compromise environmental control.