# US-First RMM Phishing Campaign Spans 46 Countries via Disposable Vercel/Netlify Infrastructure and Password-Protected VBS-to-PowerShell Delivery

> ANY.RUN research documents a broad, ongoing phishing operation that lures victims with CRA/T4 tax, SSA, Adobe PDF, invoice/VAT, and shipping-themed pages hosted on disposable free-tier infrastructure (Vercel, Netlify, GitHub Pages, compromised sites) to trick them into extracting a password-protected ZIP whose embedded VBScript launches PowerShell to download and silently install legitimate, code-signed RMM software (GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, ITarian) for hands-on-keyboard access. Across a 174-day observation window (Feb 5-Jul 29, 2026) ANY.RUN connected 601 cases spanning 46 countries and 425 phishing-kit URLs across 240 hosts, 94% of which were live for a single day, with the United States accounting for 45% of activity and education, technology, government, banking, finance, and manufacturing as the top-targeted sectors.

- **Published:** 2026-09-03T00:00:00Z
- **Last reviewed:** 2026-09-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2308
- **ID:** TL-2026-2308
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ANY.RUN's US-First RMM Phishing Campaign research traces a delivery-kit family that abuses legitimate, code-signed remote monitoring and management (RMM) software as its final payload rather than deploying traditional malware, allowing it to evade signature- and reputation-based detection. The kit was first observed in January 2026 as a single case and grew to a steady cadence of 17-33 connected cases per month; over a 174-day tracking window (February 5 to July 29, 2026) ANY.RUN identified 425 distinct phishing-kit URLs spread across 240 hosts and 155 unique resolving IPs, with 94% of hosts (225/240) observed for only a single day and 95% (228/240) for three days or fewer, evidencing deliberate rapid infrastructure rotation to defeat blocklisting.

The delivery chain is consistent across lure themes: a phishing email links to a disposable lure page (most heavily on *.vercel.app, with smaller volumes on *.netlify.app, GitHub Pages, compromised legitimate websites, and throwaway domains on cheap TLDs such as .vu/.sbs/.cfd/.icu/.top/.one/.cyou/.shop/.online/.site, plus dynamic-DNS hosts under ddnsking.com/swoop2.me/letsgo2.me/net2me.me). The lure page masquerades as a document portal (Canada Revenue Agency T4 tax slip, US Social Security Administration notice, Adobe PDF/Flash updater prompt, invoice/VAT alert, shipping notice, or a generic shared-file/streaming invite) and redirects to a secure.html gate that displays an 'access code' and offers a password-protected project/*.zip archive. Because the archive is password-protected, it returns HTTP 200 to automated crawlers and sandboxes but remains opaque to content inspection - a deliberate anti-analysis property. A victim who extracts the archive using the on-page code runs a VBScript that uses FileSystemObject to invoke PowerShell, which after a short sleep delay (further sandbox evasion) retrieves an RMM installer MSI from rotating staging infrastructure (Amazon S3, Cloudflare R2/DigitalOcean Spaces, GitHub, gofile.io, Dropbox, or compromised/raw-IP hosts) and silently installs it, granting the operator legitimate, signed hands-on-keyboard remote access that blends into normal IT administrative activity.

Despite domain and host churn, the kit shares durable fingerprintable assets across the whole family: an 'fmtt' web font served at img/font1.woff2 (present across all 425 kit URLs and 240 hosts), a Word icon mislabeled as a PDF icon (icons8-microsoft-word-94.png, misrepresented with alt text 'PDF Icon'), the secure.html -> project/*.zip delivery structure, and FingerprintJS-based browser/IP/geolocation fingerprinting combined with hCaptcha and Telegram Bot API (api.telegram.org) callouts used to filter out automated visitors and researchers before serving the payload. Per-recipient link paths follow a slug-epoch-hex pattern (/ftx/<6-char slug>-<10-digit epoch>-<12-hex>/), and a median link is first observed within 32 minutes of generation (77% within 24 hours), consistent with links being minted per target rather than mass-distributed.

Within the family, a dedicated CRA/T4 Canadian-tax-themed arm (27 of the observed Vercel apps, peaking at 23 apps in March 2026 during Canadian tax-filing season) delivers the password-ZIP -> VBS -> PowerShell chain to a GoToResolve or LogMeInRescue (LogMeInResolve_Unattended.msi) unattended installer; sibling Adobe-PDF, SSA, and compromised-WordPress-site variants reuse the same fmtt/font1.woff2 kit fingerprint but stage ScreenConnect, ConnectWise, or ITarian installers instead. Family-wide, ANY.RUN observed 204 cases tied to ScreenConnect and 106 to ConnectWise outside the CRA/T4 arm, with GoTo Resolve dominant by network telemetry (TLS SNI/DNS to gotoresolve.com) and 46 cases directly tied to LogMeIn Rescue/Resolve (detectable via the LOGMEINRESCUE named mutex). A durable origin IP, 46.62.197[.]232 on port 7000, was observed persisting across the churn of front-end hosting.

No named threat actor or malware family has been attributed to the campaign; ANY.RUN characterizes it as either a single operator or a phishing-as-a-service kit shared across multiple operators, based on the consistency of kit assets (font, icon, delivery-chain structure) despite the diversity of RMM payloads and lure themes. Because the final payload is legitimate, vendor-signed software rather than malware, detection must focus on the delivery chain (disposable-host lure -> access-code gate -> password ZIP -> VBS -> PowerShell -> unexpected RMM MSI) and on baselining/alerting against an organization's approved RMM tool inventory, rather than on AV signatures for the RMM installers themselves.

## MITRE ATT&CK

- T1583.006 Acquire Infrastructure: Web Services
- T1583.001 Acquire Infrastructure: Domains
- T1584 Compromise Infrastructure
- T1566.002 Phishing: Spearphishing Link
- T1204.002 User Execution: Malicious File
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1219 Remote Access Tools

## Sources

- [U.S. Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries](https://thehackernews.com/2026/09/us-becomes-top-target-in-rmm-phishing.html)
- [US-First RMM Phishing Campaign: Malware Analysis](https://any.run/cybersecurity-blog/us-campaign-malware-analysis/)
- [A Single Canadian Tax Lure Spread into a 46-Country, US-First RMM Campaign](https://hackernoon.com/a-single-canadian-tax-lure-spread-into-a-46-country-us-first-rmm-campaign)
- [Hackers Abuse Legitimate RMM Tools in 46-Country Phishing Campaign to Gain Remote Access](https://cybersecuritynews.com/hackers-abuse-legitimate-rmm-tools-3/)
- [RMM Phishing Campaign Spans 46 Countries as Attackers Abuse Trusted Remote Access Tools](https://www.esecurityplanet.com/phishing/news-rmm-phishing-remote-access/)
- [New Phishing-to-RMM Attacks: How Analysts Can Detect Trusted-Tool Abuse](https://cybersecuritynews.com/phishing-to-rmm-attacks-detection/amp/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2308