Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update

Summary

Cybersecurity researchers have identified Operation BlueDash, a phishing campaign attributed to Nigerian threat actors that uses fake Microsoft Teams and Zoom update lures to deliver legitimate RMM tools including Level RMM, ConnectWise ScreenConnect, and Tactical RMM. The attack chain directs victims to counterfeit Microsoft Store pages where they download 'supportdev.exe', an Inno Setup loader that deploys multiple RMM tools for persistent remote access and provides redundant backdoor access. Infrastructure analysis reveals the campaign has been active since at least February 2026, with GitHub repositories hosting phishing templates and payloads.

Full text

Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update Ravie LakshmananJul 27, 2026Malware / Cyber Attack Cybersecurity researchers have flagged a Microsoft Teams-themed phishing campaign that employs "secure document" lures to deliver legitimate remote monitoring and management (RMM) tools. "The victim was directed through compromised web infrastructure to a counterfeit Microsoft Store page claiming that Microsoft Teams had to be updated before the shared document could be opened," ZeroBEC said in a report published last week. The bogus Teams page in question is "teamvem[.]com." The active download is used to deliver "supportdev.exe," an Inno Setup-based loader that launches PowerShell in a hidden window, fetches an official Level RMM installer, and registers the endpoint using an attacker-controlled enrollment secret ("LEVEL_API_KEY=GxSCHE8EZwfyYN3iPQHPai8D"). The same PowerShell command has been found to download and deploy ConnectWise ScreenConnect in parallel, indicating an attempt to drop multiple RMM tools with an intent to establish persistent remote access. This is not the first time threat actors have abused RMM tools to their advantage. Earlier this year, Microsoft warned of multiple phishing campaigns that used workplace meeting lures and PDF attachments to distribute signed malware dubbed TrustConnect, which then acted as a conduit for ScreenConnect, along with other RMM programs like Tactical RMM and MeshAgent. Another campaign documented by ZeroBEC in May 2026 involved the use of phishing emails that purported to share secure documents in order to kick off an attack chain that stealthily dropped RMM backdoors. The latest set of phishing attacks has been codenamed Operation BlueDash, with the email security company attributing it with moderate-to-high confidence to a threat actor group operating from Nigeria based on an analysis of infrastructure, code history, and a GitHub environment used to operate the campaigns. The deployment of multiple RMM tools on the same host is seen as an attempt to set up redundant access and improve resilience in the event one of the programs is detected and removed from the environment. Subsequently, the threat actors have been observed attempting to explore the infected host, running commands to determine if it's pending a reboot or whether the system volume was protected, measure active firewall profiles, enumerate members of the local Administrators group, and identify the local Administrators group name. "This sequence suggests a practical operator checklist: determine system state, understand encryption and firewall posture, and identify privileged local users before deciding how to continue," ZeroBEC said. "It also provides defenders with a behavioral detection opportunity because the commands originate through an unauthorized RMM context rather than an approved IT workflow." Further analysis of the threat actor infrastructure ("support[.]berrydev[.]xyz") has uncovered a GitHub Pages domain ("berry4603.github[.]io") and a repository named "Bluedashltd" that contains the phishing source, CNAME configuration, and SupportDev payload. The commit history indicates that the campaign has been active since at least February 2026, when the repository was created with the fake Microsoft Store page featuring an "update" for Teams. What's more, a second repository ("rustovni") tied to the same GitHub account has been found to host a Zoom meeting lure along with its payload-delivery components. The end goal, in this case, is to download the Tactical RMM agent from its official GitHub release, install it in the Windows temporary directory, and register the compromised host with the attacker using an embedded authentication token. The Zoom-themed operation also suggests that the threat actors are running a multi-brand scheme that keeps the core intact, while altering the workplace application lure, payload host, and the remote management platform. The disclosure comes as ZeroBEC detailed JIVS PhishKit, a coordinated mailbox credential-harvesting campaign targeting multiple users within the same organization to deliver a provider-agnostic phishing page that can target Microsoft 365, Google Workspace, cPanel, Roundcube, Zimbra, and other email identities. The earliest artifact related to the effort dates back to August 21, 2025. "The messages used an authenticated but unrelated external sender, warned that each recipient mailbox had violated policy, and directed users to a live PHP phishing page on corychase[.]org," the company said. "The landing page was not a Microsoft clone. It presented a generic 'Session Expired' form that could be used against Microsoft 365, Google Workspace, hosted webmail, or almost any corporate identity." The kit is designed to siphon a corporate email address and the password entered for that mailbox. No session cookies, OAuth tokens, multi-factor authentication (MFA) codes, or browser sessions are exfiltrated. The development also follows the takedown of the Kratos (formerly Sneaky 2FA) phishing-as-a-service (PhaaS) kit by German authorities in collaboration with the U.S. and Indonesia, in addition to the arrest of its alleged developer and technical administrator. The operation is estimated to have earned more than €300,000 ($342,000) since 2024. More than 1,800 criminal enterprises are believed to have used Kratos, resulting in around 15,000 phishing campaigns per month. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Cyber Attack, email security, endpoint security, Malware, Microsoft, Phishing, Remote Access, Social Engineering, Threat Intelligence, Windows Security ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources Identity Fraud Is Changing Fast. See the Attacks Businesses Face in 2026 What 25 Million Alerts Reveal About the Threats SOCs Ignore How to Find and Control Every Script Running Through Your Marketing Stack Modern SASE Guide: Close the Gaps Traditional Network Security Cannot See

Indicators of Compromise

• domain — teamvem.com
• domain — support.berrydev.xyz
• domain — berry4603.github.io
• malware — supportdev.exe
• malware — TrustConnect

Entities