# Abuse of Legitimate NinjaOne RMM Agent in Fiscal-Lure Phishing Campaign Targeting Brazilian Organizations (Cato CTRL)

> An active, previously undocumented phishing campaign abuses the legitimate NinjaOne RMM agent to gain hands-on-keyboard administrative access to Brazilian organizations. Victims in finance, procurement, and administrative roles are lured with fake Brazilian fiscal-document portals impersonating SEFAZ and Reclame Aqui, then convinced to install a genuine NinjaOne agent pre-configured to attacker-controlled infrastructure, evading traditional malware detection.

- **Published:** 2026-06-14T00:00:00Z
- **Last reviewed:** 2026-06-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0790
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-ninjaone-rmm-fiscal-lure-tl-2026-0790.webp?v=539c2f30 (Threadlinqs threat intel: NinjaOne RMM Abuse Targets Brazil: Detection & IOCs (TL-2026-0790) — High severity, 21 IOCs, 9 detection rules.)
- **ID:** TL-2026-0790
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (3 shown free below)

## Description

Cato CTRL documented a Brazil-focused social-engineering operation that weaponizes a legitimate Remote Monitoring and Management (RMM) tool rather than custom malware. The intrusion begins with routine-appearing phishing emails that redirect through Google infrastructure (bc.googleusercontent.com relay pattern) to Portuguese-language portals impersonating trusted Brazilian institutions — the SEFAZ state tax authority (via sefaz[.]services) and the Reclame Aqui consumer-complaint platform (via reclameaqui[.]services), alongside staging domains r64.org, hairdb.com, lazybearpottery.net, and rectalmania.com. The fake portals present 'secure document' / 'fiscal document' verification workflows aimed at procurement, finance, accounting, and administrative personnel who routinely handle supplier and tax paperwork. In some cases operators follow up by phone, guiding victims to install 'required software.'

The delivered file is a genuine NinjaOne RMM agent named to look like a fiscal document (e.g. NinjaOne-Agent-DocumentoFiscal21782856920262001238-Sede-Auto-x86-64). Because the binary is signed, legitimate, and common in enterprise environments, most endpoint and network controls do not flag it. Once installed, the agent is configured to call back to attacker-controlled NinjaOne tenancy/infrastructure, granting the operators administrative-level capabilities native to the platform: endpoint monitoring and reconnaissance, asset inventory, remote shell / command execution, file transfer (tool upload and data exfiltration), software deployment, patch management, and scripted automation — all blending into legitimate IT operations.

The campaign is wrapped in a sophisticated anti-analysis delivery layer. Payload delivery is geofenced to Brazilian IP ranges, limiting researcher visibility. Client-side JavaScript performs sandbox/automation detection (checks for Selenium, Puppeteer, Playwright, WebDriver, PhantomJS, and Nightmare), user-presence validation (mouse movement, scrolling, and touch interaction), and honeypot validation that flags automated form-fillers with the Portuguese marker 'Bot preencheu o honeypot.' The payload is served through a hidden iframe that is removed roughly 30 seconds after execution, right-click is disabled on download elements, and artifact-cleanup logic erases traces. Researchers pivoted on a shared Earth-themed wallpaper image (depicting the Americas) displayed by multiple attacker domains to expand visibility into the broader infrastructure. Cato CTRL observed command-and-control infrastructure and visual-asset overlaps with previously documented Venon RAT activity — a Brazilian, Rust-based RAT operation — suggesting a possible operational relationship or shared infrastructure, but stopped short of definitive attribution.

## MITRE ATT&CK

- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1566 Phishing
- T1204 User Execution
- T1543 Create or Modify System Process
- T1497 Virtualization/Sandbox Evasion
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1036 Masquerading
- T1082 System Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Fiscal-Document-Named RMM Installer Dropped/Executed (NinjaOne Masquerade) — Exploitation** (`TL-2026-0790-SPL-001`)

Detects the initial-access stage of the NinjaOne fiscal-lure chain: a genuine but renamed NinjaOne RMM agent masqueraded as a Brazilian fiscal document (DocumentoFiscal<digits>, Documento-Sede-Auto) written to a user Downloads folder and executed. Fires on the masquerade filename pattern in Sysmon file-create (EventCode 11) and process-create (EventCode 1) telemetry, catching the user-execution of the malicious file before the agent enrolls.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1204.002, T1036.008, T1036.005
- **Data sources:** sysmon, microsoft_defender_endpoint, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=11 OR EventCode=1)
| eval fname=coalesce(TargetFilename, Image)
| where (like(fname, "%\\Downloads\\%") OR EventCode=1)
| where match(fname, "(?i)(NinjaOne-Agent-Documento|DocumentoFiscal\d+|Documento.*Sede-Auto)")
| where match(fname, "(?i)\.exe$") OR EventCode=1
| stats count min(_time) as firstSeen max(_time) as lastSeen values(EventCode) as event_codes values(fname) as files by host, User
| convert ctime(firstSeen) ctime(lastSeen)
| `comment("Genuine signed NinjaOne agent renamed as a fiscal document = T1036.008/T1036.005 masquerade + T1204.002 user execution")`
```

### Microsoft KQL

```kql
// Fiscal-document-named RMM installer dropped or executed
let markers = dynamic(["NinjaOne-Agent-Documento","DocumentoFiscal","Sede-Auto"]);
union
  (DeviceFileEvents
   | where Timestamp > ago(24h)
   | where FolderPath has "\\Downloads\\" and FileName endswith ".exe"
   | where FileName has_any (markers)
   | project Timestamp, DeviceName, AccountUpn=InitiatingProcessAccountName, Action="file_drop", FileName, FolderPath),
  (DeviceProcessEvents
   | where Timestamp > ago(24h)
   | where FileName has_any (markers) or ProcessCommandLine has_any (markers)
   | project Timestamp, DeviceName, AccountUpn=AccountName, Action="process_exec", FileName, FolderPath)
| sort by Timestamp desc
```

### Sigma

```yaml
title: Fiscal-Document-Named RMM Installer in Downloads (NinjaOne Masquerade)
id: 6f1c2a40-7b3e-4d51-9a02-0790a1b2c3d4
status: experimental
description: Detects a fiscal-document-named NinjaOne RMM agent (DocumentoFiscal/Sede-Auto) written to a Downloads folder, the masqueraded payload of the Cato CTRL Brazilian fiscal-lure RMM abuse chain.
references:
  - https://www.catonetworks.com/blog/cato-ctrl-previously-undocumented-ninjaone-rmm-abuse-chain/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-06-14
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.execution
  - attack.t1204.002
  - attack.defense_evasion
  - attack.t1036.008
  - attack.t1036.005
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains: '\Downloads\'
    TargetFilename|contains:
      - 'NinjaOne-Agent-Documento'
      - 'DocumentoFiscal'
      - 'Sede-Auto'
    TargetFilename|endswith: '.exe'
  condition: selection
falsepositives:
  - Legitimate IT-sanctioned NinjaOne deployment that happens to use a documento-style filename (rare)
level: high
```

**Known false positives:**

- Sanctioned NinjaOne rollout using an unusual document-style installer name
- Security-team test/EICAR-style files mimicking the lure

**Tuning notes:** Exclude file paths under your sanctioned RMM deployment share or known IT staging accounts. Tighten the regex to your locale's fiscal-document naming if FP volume is high; add hash allowlisting once the genuine NinjaOne agent hash is known.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Anti-Sandbox Fiscal Portal Fingerprinting & Honeypot Markers — Exploitation (locked: unlock with TL Creds)
- RMM Agent Discovery & Recon From Unmanaged Endpoint — Post-Exploitation (locked: unlock with TL Creds)
- Periodic RMM Beacon to Unsanctioned NinjaOne Tenant + Ingress Tool Transfer — C2 / Lateral (locked: unlock with TL Creds)
- Hidden-Iframe Payload Delivery & Indicator Removal on Fiscal Portal — Exploitation (locked: unlock with TL Creds)
- Linux RMM Masquerade + systemd Persistence (NinjaOne Abuse) — Post-Exploitation (locked: unlock with TL Creds)
- Callback-Phishing Relay via googleusercontent to Fiscal-Lure Domain — C2 / Lateral Enabler (locked: unlock with TL Creds)
- Unauthorized NinjaOne RMM Service Persistence on Unmanaged Host — Post-Exploitation (locked: unlock with TL Creds)
- Fiscal-Lure Portal & Unsanctioned RMM Tenant C2 Traffic — C2 / Lateral (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 21)

Defanged, TLP:CLEAR.

- Domain: `r64[.]org`
- Domain: `hairdb[.]com`
- Domain: `lazybearpottery[.]net`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Cato CTRL Threat Research: From Fiscal Lures to Remote Access, A Previously Undocumented NinjaOne RMM Abuse Chain](https://www.catonetworks.com/blog/cato-ctrl-previously-undocumented-ninjaone-rmm-abuse-chain/)
- [Hackers Abuse Legitimate NinjaOne RMM Software to Bypass Traditional Malware Detection](https://cybersecuritynews.com/hackers-abuse-legitimate-ninjaone-rmm-software/)
- [Hackers Abuse NinjaOne RMM Agent to Gain Remote Access to Brazilian Organizations](https://gbhackers.com/hackers-abuse-ninjaone-rmm-agent/)
- [Hackers Use Fake Fiscal Documents to Deliver NinjaOne RMM Agent for Remote Access](https://cyberpress.org/fake-fiscal-docs-deploy-ninjaone/)
- [Hackers Abuse Legitimate NinjaOne RMM Software (Cryptika mirror)](https://www.cryptika.com/hackers-abuse-legitimate-ninjaone-rmm-software-to-bypass-traditional-malware-detection/)
- [Cisco Talos: Spam campaign targeting Brazil abuses Remote Monitoring and Management tools (related RMM-abuse context)](https://blog.talosintelligence.com/spam-campaign-targeting-brazil-abuses-rmm-tools/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0790