Cross-Platform Phishing Campaigns Auto-Adapt Payloads to Victim Device/OS via Fingerprinting
Cross-Platform Phishing Campaigns Auto-Adapt Payloads to (TL-2026-1126), also tracked as The Platform You Trust Is the Platform They Target, is a high-severity phishing campaign, first published 2026-07-01. It has no confirmed attribution, affects Tiflux Sistema de Gestão LTDA Tiflux RMM Agent (abused as 'Tiflux RAT', maps to 40 MITRE ATT&CK techniques (T1005, T1021.001, T1027), and is covered by 9 detection rules and 34 indicators of compromise.
Key facts for TL-2026-1126
- Threat ID
- TL-2026-1126
- Also known as
- The Platform You Trust Is the Platform They Target, Cross-Platform Fingerprinting Phishing
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-07-01
- Last reviewed
- 2026-07-01
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, health, government administration, professionalservices, manufacturing, technology, retail, legal
- Target regions
- Global, North America, Europe, 005 - South America
- Detection rules
- 9
- Indicators of compromise
- 34
Malware and tooling in Cross-Platform Phishing Campaigns Auto-Adapt Payloads to
Malware and tooling: Kepavll, Screwon, ConnectWise ScreenConnect, FleetDeck.io, HwRwDrv.sys, Itarian RAT, Ninite Loader, Tiflux RAT
Cofense Intelligence, reported by Dark Reading on 2026-07-01, documents a shift in phishing tradecraft: landing pages fingerprint victims via User-Agent and browser telemetry (device info, language, local time, screen/window size, geolocation, harvested email address) and then branch delivery per platform — Windows victims receive RAT/RMM installers (Tiflux RAT, or a Ninite Loader chain delivering Itarian RAT then ConnectWise/ScreenConnect), macOS victims receive a repurposed legitimate RMM agent (FleetDeck) or a credential-phishing redirect, and Android victims are redirected to credential-harvesting pages. Landing pages dynamically mimic Google, Docusign, Microsoft Teams, Adobe, and Zoom download/sign-in screens based on the collected telemetry.
How Cross-Platform Phishing Campaigns Auto-Adapt Payloads to works
Cofense Intelligence describes a clear evolution in phishing operations: campaigns that were once simple, Windows-only malware droppers now perform User-Agent/browser fingerprinting on a single landing page and branch the attack chain according to the victim's detected operating system. The fingerprinting script harvests the victim's email address (often pre-filled from the phishing link), browser/device information, language, local time, screen and window size, and geolocation, then uses that data — and in some observed cases Cloudflare User-Agent-based edge redirects that route traffic by perceived OS before the victim ever reaches the malicious page — to decide which lure and payload to serve.
On Windows, victims are served either a Tiflux RAT installer or, in a related fingerprinting chain also documented by Cofense, an Itarian RAT payload that further fingerprints the host and hands off to a Ninite Loader which in turn deploys a ConnectWise (ScreenConnect) remote-access payload. On macOS, the same landing page instead serves FleetDeck, a boutique legitimate remote-monitoring-and-management (RMM) agent that is repurposed as unauthorized remote access, or redirects the victim to a credential-phishing page mimicking a trusted brand. Android visitors are likewise redirected to credential-harvesting pages rather than served an executable payload. Across variants, the decoy landing pages are dynamically dressed to resemble Google, Docusign, Microsoft Teams, Adobe, or Zoom download or sign-in screens depending on the fingerprint collected, maximizing the credibility of the lure for the victim's actual software environment.
The Windows RAT-delivery vector cited in the Cofense/Dark Reading reporting overlaps technically with a Tiflux RMM malspam cluster analyzed in depth by Huntress beginning around 2026-02-27: phishing emails impersonating a 'Network Solutions Service Agreement' route victims through a Cloudflare CAPTCHA-gated landing page (lenwillfilenetwork.com) that displays a spoofed macOS-style CAPTCHA popup even to Windows browsers, then serves an MSI installer (Network Solutions Agreement.msi / Adobeclient-33.2.msi) signed by 'Tiflux Sistema de Gestão LTDA.' The resulting Tiflux agent establishes a TiPeerToPeer UDP backchannel, profiles the host via osqueryl.exe, captures and transmits screenshots, and daisy-chains additional remote-access tools (UltraVNC 1.2.0.1 with an expired 2014 certificate, Splashtop, and ScreenConnect) for redundant access. A known-vulnerable, long-expired-certificate driver (HwRwDrv.sys) capable of privilege escalation is also dropped without clear operational justification, and the malware installs SSH host keys for passwordless PuTTY access and disables Windows Secure Attention Sequence notifications. Build-path metadata ties the toolkit to a 'PeopleOne' developer identity, and its SSH C2 endpoint (remote1a.peopleone.com.br) went offline around 2026-05-07.
A second, closely related cluster documented by Microsoft (2026-03-03) shows the same brand-impersonation lure set — fake meeting invitations and document notifications spoofing Microsoft Teams, Zoom, Adobe Reader, Google Meet, and DocSign — delivering executables signed with an abused Extended Validation certificate issued to 'TrustConnect Software PTY LTD.' These droppers (Microsoft Defender family names Kepavll/Screwon) install ScreenConnect, Tactical RMM, and MeshAgent as backdoors, registering a Windows service and a Run-key persistence entry, and reach out to a dedicated C2 domain set (trustconnectsoftware.com, turn.zoomworkforce.us, rightrecoveryscreen.top, smallmartdirect.com) and IP infrastructure. This TrustConnect cluster is not confirmed by Cofense to be the identical operation described in the fingerprinting report, but it demonstrates the same brand-impersonation-plus-RMM-backdoor tradecraft that the fingerprinting campaign's Windows/macOS lures rely on, and is documented here as directly relevant supporting evidence for the lure and payload ecosystem.
On macOS, the broader threat ecosystem Cofense's report sits within also includes DMG-based deceptive installer campaigns (documented separately by Huntress) that abuse Gatekeeper's Right-Click-to-Open behavior, hidden '.background' folders containing social-engineering artwork, and cracked-software/AI-tool lures to deliver infostealers (AMOS, Poseidon, Odyssey, MacSync) — reinforcing that macOS is now a first-class target for platform-aware phishing rather than an afterthought. FleetDeck itself has a documented history of criminal abuse dating to 2024, when French- and German-language invoice-themed phishing emails delivered FleetDeck installers under the guise of an 'Adobe FleetDeck' viewer requirement (per Cofense's 'New Weapon of Choice' report), and a parallel Brazilian Labor Court-themed campaign delivered Atera-with-Splashtop for the same purpose — establishing that RMM-abuse-for-initial-access is a mature, reused criminal tactic that the newly reported fingerprinting logic now layers platform-detection on top of.
No CVE or CVSS applies: this is a tradecraft/campaign report describing social-engineering and living-off-trusted-software abuse rather than a software vulnerability. Attribution is not established by any source reviewed; Cofense does not name a specific threat actor or group, and the overlapping Tiflux/PeopleOne and TrustConnect clusters appear to be separate, financially-motivated criminal operations rather than a single named APT.
MITRE ATT&CK techniques used in TL-2026-1126
Collection
T1005 Data from Local System; T1113 Screen Capture; T1119 Automated Collection
Lateral Movement
T1021.001 Remote Desktop Protocol; T1570 Lateral Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1564.001 Hidden Files and Directories
Exfiltration
T1041 Exfiltration Over C2 Channel
Credential Access
T1056.001 Keylogging; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Execution
T1059.001 PowerShell; T1204.001 Malicious Link; T1204.002 Malicious File
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071.001 Web Protocols; T1090 Proxy; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery; T1087.001 Local Account; T1087.004 Cloud Account; T1518 Software Discovery
Persistence
T1133 External Remote Services; T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder; T1547.014 Active Setup
Initial Access
T1189 Drive-by Compromise; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
stealth
defense-impairment
Resource Development
T1583.001 Domains; T1588.003 Code Signing Certificates; T1608.001 Upload Malware
Affected products and versions in Cross-Platform Phishing Campaigns Auto-Adapt Payloads to
- Tiflux Sistema de Gestão LTDA — Tiflux RMM Agent (abused as 'Tiflux RAT' payload)
Vulnerable versions: all - legitimate signed installer abused for malicious delivery
Fixed in: N/A - not a product vulnerability; abuse of legitimate signed software - FleetDeck — FleetDeck Remote Desktop Agent (macOS/Windows)
Vulnerable versions: all - legitimate agent installer repurposed for malicious delivery
Fixed in: N/A - not a product vulnerability - ConnectWise — ScreenConnect
Vulnerable versions: all - trial/licensed installer abused for secondary RMM persistence
Fixed in: N/A - not a product vulnerability - Itarian — Itarian RMM/RAT client
Vulnerable versions: all - abused as fingerprinted Windows payload
Fixed in: N/A - not a product vulnerability - Ninite — Ninite Loader
Vulnerable versions: all - abused as loader stage
Fixed in: N/A - not a product vulnerability - Google — Google Sign-In (impersonated brand)
Vulnerable versions: N/A - brand impersonation, not a software flaw
Fixed in: N/A - Docusign — Docusign (impersonated brand)
Vulnerable versions: N/A - brand impersonation, not a software flaw
Fixed in: N/A - Microsoft — Microsoft Teams (impersonated brand)
Vulnerable versions: N/A - brand impersonation, not a software flaw
Fixed in: N/A - Adobe — Adobe Acrobat/Reader (impersonated brand)
Vulnerable versions: N/A - brand impersonation, not a software flaw
Fixed in: N/A - Zoom — Zoom Workplace (impersonated brand)
Vulnerable versions: N/A - brand impersonation, not a software flaw
Fixed in: N/A
Remediation for Cross-Platform Phishing Campaigns Auto-Adapt Payloads to
Patches
- No CVE or vendor patch applies — this is a tradecraft/campaign report involving abuse of legitimate signed software, not a software vulnerability
- Where a known-vulnerable signed driver is dropped for local privilege escalation (HwRwDrv.sys), enforce Microsoft's vulnerable-driver blocklist via HVCI/Smart App Control
Immediate actions
- Block/deny-list confirmed C2 and payload-hosting domains and IPs (lenwillfilenetwork.com, anythinghere.woremix.icu, shankar.woremix.icu, remote1a.peopleone.com.br, hg.lawdepotisland.com, trustconnectsoftware.com, turn.zoomworkforce.us, rightrecoveryscreen.top, smallmartdirect.com, 84.54.33.192, 136.0.157.51, 154.16.171.203, 173.195.100.77, 66.150.196.166) at email gateway, proxy, and firewall
- Quarantine and hash-block known malicious installers (Network Solutions Agreement.msi, Adobeclient-33.2.msi, ScreenConnect.msi variants) across EDR/AV
- Revoke trust for the TrustConnect Software PTY LTD code-signing certificate and flag any Tiflux-signed binary not explicitly approved by IT
- Alert on unsolicited installation of any RMM tool (Tiflux, FleetDeck, Itarian, ConnectWise/ScreenConnect, Ninite, Splashtop, UltraVNC, Atera, TacticalRMM, MeshAgent) not on the enterprise allow-list
Workarounds
- Restrict outbound access for any approved RMM client process to only sanctioned management servers via network egress filtering
- Disable auto-execution of MSI/PKG/DMG downloads originating from non-corporate mail or web sources at the endpoint policy level
Longer-term hardening
- Deploy application allow-listing (WDAC/AppLocker) restricting which RMM/remote-access binaries may execute in the environment
- Implement EDR behavioral detection for RMM daisy-chaining, i.e. one remote-access tool silently installing a second
- Deploy link-detonation/browser isolation for first-seen sender links and attachments to defeat User-Agent-based landing-page fingerprinting and Cloudflare-based OS redirects
- Harden macOS Gatekeeper enforcement and monitor for DMG mount events and hidden .background installer-lure directories
- Extend phishing-awareness training to explicitly cover cross-platform lures (Windows, macOS, Android) and workplace-app impersonation (Teams, Zoom, Adobe, Docusign, Google)
Weaknesses (CWE) in Cross-Platform Phishing Campaigns Auto-Adapt Payloads to
CWE-451, CWE-494, CWE-829
Timeline of Cross-Platform Phishing Campaigns Auto-Adapt Payloads to
- Cofense observes French- and German-language invoice/payment-themed phishing emails delivering FleetDeck RMM installers under an 'Adobe FleetDeck' viewer-requirement pretext, an early precursor establishing FleetDeck as a criminal RMM-abuse tool later reused as the macOS payload in the fingerprinting campaign.
- A Brazilian Labor Court-themed phishing campaign begins delivering Atera RMM installers with Splashtop integration for unauthorized remote access, per Cofense's 'New Weapon of Choice' report, demonstrating the broader RMM-hijacking tactic base this campaign builds on.
- Huntress observes a marked uptick in Tiflux RMM malspam incidents, beginning with a fake 'Network Solutions Service Agreement' phishing lure that installs a Tiflux-signed MSI and daisy-chains UltraVNC, Splashtop, and ScreenConnect.
- Microsoft Security publishes analysis of signed malware impersonating Microsoft Teams, Zoom, Adobe Reader, Google Meet, and DocSign, using an abused TrustConnect Software PTY LTD EV code-signing certificate to deploy ScreenConnect, Tactical RMM, and MeshAgent backdoors — the same brand-impersonation lure set later cited in the fingerprinting campaign report.
- Huntress publishes 'Threat Actors Weaponize Tiflux RMMs in Malspam Attacks,' detailing the full Tiflux/PeopleOne infection chain, C2 infrastructure, and the dropped known-vulnerable HwRwDrv.sys driver.
- The Tiflux campaign's SSH command-and-control endpoint (remote1a.peopleone.com.br) is observed offline, indicating infrastructure rotation or takedown.
- Huntress publishes 'Deceptive Installers: How Fake Apps Target macOS,' documenting DMG-based, Gatekeeper-bypassing macOS lure techniques and infostealers (AMOS, Poseidon, Odyssey, MacSync) that form the broader macOS threat backdrop for this campaign's FleetDeck/credential-redirect payloads.
- Huntress publishes 'Daisy Chaining Rogue RMM Tools,' documenting the broader criminal pattern of chaining multiple remote-management tools (ScreenConnect, Action1, SimpleHelp, AnyDesk, Atera, UltraVNC, and others) for redundant, attribution-resistant access, noting RMM abuse accounted for 24% of observed incidents (up 277% year over year).
- The Hacker News includes the cross-platform fingerprinting phishing campaign in its ThreatsDay bulletin roundup alongside other concurrent threat stories.
- Dark Reading (Alexander Culafi) publishes coverage of the Cofense research, amplifying visibility of the cross-platform fingerprinting phishing tactic to the broader security community.
- Cofense Intelligence publishes 'The Platform You Trust Is the Platform They Target,' formally documenting the cross-platform, User-Agent-fingerprinting phishing landing page that serves Tiflux RAT or an Itarian RAT/Ninite Loader/ConnectWise chain on Windows, FleetDeck or credential-phishing redirects on macOS, and credential-harvesting redirects on Android, with lures mimicking Google, Docusign, Teams, Adobe, and Zoom.
Sources cited for Cross-Platform Phishing Campaigns Auto-Adapt Payloads to
- Crafty Phishing Campaigns Auto-Adapt to Victim's Device, OS
- The Platform You Trust Is the Platform They Target
- New Weapon of Choice - How Threat Actors Hijack Legitimate Remote Access Tools
- Threat Actors Weaponize Tiflux RMMs in Malspam Attacks
- Daisy Chaining Rogue RMM Tools
- Deceptive Installers: How Fake Apps Target macOS
- Signed malware impersonating workplace apps deploys RMM backdoors
- ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories
- The Platform You Trust Is the Platform They Target (mirror)
- The Platform You Trust Is the Platform They Target (mirror)
- The Platform You Trust Is the Platform They Target (mirror)
- Tiflux RMM Abused in Malspam Campaign
Threats related to Cross-Platform Phishing Campaigns Auto-Adapt Payloads to
- Tiflux RMM Triple-Threat Campaign — Service-Agreement Malspam Chains UltraVNC + Splashtop + ScreenConnect with BYOVD HwRwDrv.sys for Privilege Escalation
- Phishing Campaign Impersonates LastPass and Bitwarden Security Alerts to Deliver Fake DocuSign Pages
- US-First RMM Phishing Campaign Spans 46 Countries via Disposable Vercel/Netlify Infrastructure and Password-Protected VBS-to-PowerShell Delivery
Detection coverage for TL-2026-1126
As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1126 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.