# Cross-Platform Phishing Campaigns Auto-Adapt Payloads to Victim Device/OS via Fingerprinting

> Cofense Intelligence, reported by Dark Reading on 2026-07-01, documents a shift in phishing tradecraft: landing pages fingerprint victims via User-Agent and browser telemetry (device info, language, local time, screen/window size, geolocation, harvested email address) and then branch delivery per platform — Windows victims receive RAT/RMM installers (Tiflux RAT, or a Ninite Loader chain delivering Itarian RAT then ConnectWise/ScreenConnect), macOS victims receive a repurposed legitimate RMM agent (FleetDeck) or a credential-phishing redirect, and Android victims are redirected to credential-harvesting pages. Landing pages dynamically mimic Google, Docusign, Microsoft Teams, Adobe, and Zoom download/sign-in screens based on the collected telemetry.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1126
- **ID:** TL-2026-1126
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Cofense Intelligence describes a clear evolution in phishing operations: campaigns that were once simple, Windows-only malware droppers now perform User-Agent/browser fingerprinting on a single landing page and branch the attack chain according to the victim's detected operating system. The fingerprinting script harvests the victim's email address (often pre-filled from the phishing link), browser/device information, language, local time, screen and window size, and geolocation, then uses that data — and in some observed cases Cloudflare User-Agent-based edge redirects that route traffic by perceived OS before the victim ever reaches the malicious page — to decide which lure and payload to serve.

On Windows, victims are served either a Tiflux RAT installer or, in a related fingerprinting chain also documented by Cofense, an Itarian RAT payload that further fingerprints the host and hands off to a Ninite Loader which in turn deploys a ConnectWise (ScreenConnect) remote-access payload. On macOS, the same landing page instead serves FleetDeck, a boutique legitimate remote-monitoring-and-management (RMM) agent that is repurposed as unauthorized remote access, or redirects the victim to a credential-phishing page mimicking a trusted brand. Android visitors are likewise redirected to credential-harvesting pages rather than served an executable payload. Across variants, the decoy landing pages are dynamically dressed to resemble Google, Docusign, Microsoft Teams, Adobe, or Zoom download or sign-in screens depending on the fingerprint collected, maximizing the credibility of the lure for the victim's actual software environment.

The Windows RAT-delivery vector cited in the Cofense/Dark Reading reporting overlaps technically with a Tiflux RMM malspam cluster analyzed in depth by Huntress beginning around 2026-02-27: phishing emails impersonating a 'Network Solutions Service Agreement' route victims through a Cloudflare CAPTCHA-gated landing page (lenwillfilenetwork.com) that displays a spoofed macOS-style CAPTCHA popup even to Windows browsers, then serves an MSI installer (Network Solutions Agreement.msi / Adobeclient-33.2.msi) signed by 'Tiflux Sistema de Gestão LTDA.' The resulting Tiflux agent establishes a TiPeerToPeer UDP backchannel, profiles the host via osqueryl.exe, captures and transmits screenshots, and daisy-chains additional remote-access tools (UltraVNC 1.2.0.1 with an expired 2014 certificate, Splashtop, and ScreenConnect) for redundant access. A known-vulnerable, long-expired-certificate driver (HwRwDrv.sys) capable of privilege escalation is also dropped without clear operational justification, and the malware installs SSH host keys for passwordless PuTTY access and disables Windows Secure Attention Sequence notifications. Build-path metadata ties the toolkit to a 'PeopleOne' developer identity, and its SSH C2 endpoint (remote1a.peopleone.com.br) went offline around 2026-05-07.

A second, closely related cluster documented by Microsoft (2026-03-03) shows the same brand-impersonation lure set — fake meeting invitations and document notifications spoofing Microsoft Teams, Zoom, Adobe Reader, Google Meet, and DocSign — delivering executables signed with an abused Extended Validation certificate issued to 'TrustConnect Software PTY LTD.' These droppers (Microsoft Defender family names Kepavll/Screwon) install ScreenConnect, Tactical RMM, and MeshAgent as backdoors, registering a Windows service and a Run-key persistence entry, and reach out to a dedicated C2 domain set (trustconnectsoftware.com, turn.zoomworkforce.us, rightrecoveryscreen.top, smallmartdirect.com) and IP infrastructure. This TrustConnect cluster is not confirmed by Cofense to be the identical operation described in the fingerprinting report, but it demonstrates the same brand-impersonation-plus-RMM-backdoor tradecraft that the fingerprinting campaign's Windows/macOS lures rely on, and is documented here as directly relevant supporting evidence for the lure and payload ecosystem.

On macOS, the broader threat ecosystem Cofense's report sits within also includes DMG-based deceptive installer campaigns (documented separately by Huntress) that abuse Gatekeeper's Right-Click-to-Open behavior, hidden '.background' folders containing social-engineering artwork, and cracked-software/AI-tool lures to deliver infostealers (AMOS, Poseidon, Odyssey, MacSync) — reinforcing that macOS is now a first-class target for platform-aware phishing rather than an afterthought. FleetDeck itself has a documented history of criminal abuse dating to 2024, when French- and German-language invoice-themed phishing emails delivered FleetDeck installers under the guise of an 'Adobe FleetDeck' viewer requirement (per Cofense's 'New Weapon of Choice' report), and a parallel Brazilian Labor Court-themed campaign delivered Atera-with-Splashtop for the same purpose — establishing that RMM-abuse-for-initial-access is a mature, reused criminal tactic that the newly reported fingerprinting logic now layers platform-detection on top of.

No CVE or CVSS applies: this is a tradecraft/campaign report describing social-engineering and living-off-trusted-software abuse rather than a software vulnerability. Attribution is not established by any source reviewed; Cofense does not name a specific threat actor or group, and the overlapping Tiflux/PeopleOne and TrustConnect clusters appear to be separate, financially-motivated criminal operations rather than a single named APT.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1189 Drive-by Compromise
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1218.007 Msiexec
- T1547.001 Registry Run Keys / Startup Folder
- T1543.003 Windows Service
- T1547.014 Active Setup
- T1133 External Remote Services
- T1068 Exploitation for Privilege Escalation
- T1553.002 Code Signing
- T1218 System Binary Proxy Execution
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1564.001 Hidden Files and Directories
- T1555.003 Credentials from Web Browsers
- T1056.001 Keylogging
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1087.001 Local Account
- T1087.004 Cloud Account
- T1518 Software Discovery
- T1021.001 Remote Desktop Protocol
- T1570 Lateral Tool Transfer
- T1113 Screen Capture
- T1119 Automated Collection
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1071.001 Web Protocols
- T1573 Encrypted Channel
- T1090 Proxy
- T1583.001 Domains
- T1588.003 Code Signing Certificates
- T1608.001 Upload Malware

## Sources

- [Crafty Phishing Campaigns Auto-Adapt to Victim's Device, OS](https://www.darkreading.com/application-security/phishing-campaigns-auto-adapt-victims-device-os)
- [The Platform You Trust Is the Platform They Target](https://cofense.com/blog/the-platform-you-trust-is-the-platform-they-target)
- [New Weapon of Choice - How Threat Actors Hijack Legitimate Remote Access Tools](https://cofense.com/blog/new-weapon-of-choice-how-threat-actors-hijack-legitimate-remote-access-tools)
- [Threat Actors Weaponize Tiflux RMMs in Malspam Attacks](https://www.huntress.com/blog/tiflux-rmm-install)
- [Daisy Chaining Rogue RMM Tools](https://www.huntress.com/blog/daisy-chaining-rogue-rmm-tools)
- [Deceptive Installers: How Fake Apps Target macOS](https://www.huntress.com/blog/deceptive-installers-macos-infostealers)
- [Signed malware impersonating workplace apps deploys RMM backdoors](https://www.microsoft.com/en-us/security/blog/2026/03/03/signed-malware-impersonating-workplace-apps-deploys-rmm-backdoors/)
- [ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories](https://thehackernews.com/2026/07/threatsday-ai-compute-hijacking-apple.html)
- [The Platform You Trust Is the Platform They Target (mirror)](https://securityboulevard.com/2026/07/the-platform-you-trust-is-the-platform-they-target/)
- [The Platform You Trust Is the Platform They Target (mirror)](https://www.dataproof.co.za/the-platform-you-trust-is-the-platform-they-target/)
- [The Platform You Trust Is the Platform They Target (mirror)](https://cyfar.ca/posts/the-platform-you-trust-is-the-platform-they-target)
- [Tiflux RMM Abused in Malspam Campaign](https://feed.craftedsignal.io/briefs/2026-05-tiflux-rmm/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1126