ANY.RUN traced 351 sandbox analyses showing a US-focused operation that combines Microsoft 365 session theft with remote-management tool deployment, allowing attackers to move from a single phish to account takeover, persistent endpoint access, and expanded fraud.
Attackers use familiar business lures (Adobe, DocuSign, Zoom, Google Meet, Dropbox, Microsoft 365) to deliver either credential/device-code theft or installers that set up legitimate RMM tools like ScreenConnect or Action1.
Combined identity and endpoint compromise broadens impact: mailbox takeover, payment fraud, persistent remote access, and internal spread are all possible outcomes.
Defenders should reconstruct full attack chains, monitor both identity and endpoint telemetry, and control unauthorized remote-management tooling to shorten investigations and limit lateral spread.
# What happened ANY.RUN researchers analyzed 351 sandbox submissions tied to a phishing operation called CSuite. The telemetry shows the campaign heavily targeted the United States (51% of submissions), with notable activity in India (18%) and additional hits across the Philippines, Australia, the UK, Canada, and others. High-exposure sectors included technology, manufacturing, government and administration, and consulting.
# How the attack works The campaign starts with familiar business-themed lures that look like legitimate requests or documents: forged DocuSign envelopes, Adobe-file viewers, meeting links, or cloud-file prompts. From a single lure the operation takes one of two routes:
ANY.RUN captured examples where an Adobe-themed lure delivered a BAT file that elevated privileges and installed ScreenConnect, showing how quickly a browser interaction can turn into persistent remote access.
# Why this is more dangerous than ordinary phishing By combining cloud-session theft with RMM installation, CSuite converts a single successful phish into multiple long-term capabilities for the attacker:
# Concrete steps defenders should take Focus on visibility across the full attack chain and on controls for remote-management tooling.
# Practical analyst priorities
A wave of cyberattacks across the US and Europe in August exploited the trust businesses place in everyday tools, turning Microsoft 365 logins, remote-management software, and routine business documents into entry points for attackers. Security researchers tracked campaigns that combined account takeover, persistent re
Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content. "Once executed, the legitimate MSP360 installer, distributed under
KnowBe4 researchers observed a new phishing campaign leveraging Microsoft 365’s Direct Send to send malicious emails
Threat actors are impersonating corporate IT helpdesk staff in an active social-engineering campaign that hijacks Microsoft 365 identities, establishes MFA persistence, and systematically collects data from SharePoint, OneDrive, and Exchange Online. Microsoft Security Research said it has observed the cloud-focused int
Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that's targeting Microsoft 365 and other software-as-a-service (SaaS) offerings through information technology (IT) help desk vishing, adversary-in-the-middle (AitM) token theft, and residential-proxy sign-ins. The activity, w
Cybercriminals are using fake acquisition deals to steer employees toward large wire transfers. The campaign, called Phantom Deal, begins with a believable WhatsApp message from someone appearing to be a known executive. It turns everyday corporate safeguards into barriers that the victim is told must be avoided to pro
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.