US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries
RMM phishing campaign targets US with 46 countries involved, using disposable infrastructure.
Run Remote Monitoring and Management (RMM) software?
Get an email when a reviewed story names Remote Monitoring and Management (RMM) software, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A broad phishing campaign, initially thought to target Canada, has expanded to 46 countries with the United States as the primary target. The campaign uses legitimate Remote Monitoring and Management (RMM) software, tricking victims with fake documents like tax forms, invoices, and shipping notices. Attackers leverage rapidly rotating, disposable infrastructure, primarily on Vercel, to evade detection, though shared assets provide persistent indicators.
The lesson from this incident
Full lessonAttackers are weaponizing legitimate Remote Monitoring and Management (RMM) tools — software already trusted by IT teams — to bypass traditional security controls, making detection significantly harder than with custom malware. Victims are lured through convincing fake documents such as tax forms, invoices, and shipping notices, exploiting low security awareness around seemingly routine communications. The use of rapidly rotating, disposable infrastructure hosted on reputable platforms like Vercel allows attackers to evade blocklists and reputation-based defenses. This campaign highlights the dangerous intersection of social engineering and living-off-the-land techniques, where legitimate software becomes the attack vector. Organizations that fail to monitor RMM tool usage and employee phishing susceptibility are especially exposed.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.