Platform-Aware Phishing Kits Fingerprint Devices to Deliver OS-Specific RATs and Credential Harvesters

Platform-Aware Phishing Kits Fingerprint Devices to Deliver (TL-2026-2452) is a high-severity phishing campaign, first published 2026-09-11. It has no confirmed attribution, affects Microsoft Windows (desktop endpoints), maps to 12 MITRE ATT&CK techniques (T1027, T1036, T1056), and is covered by 9 detection rules and 13 indicators of compromise.

Key facts for TL-2026-2452

Threat ID
TL-2026-2452
Severity
HIGH
Status
ACTIVE
Category
PHISHING
First published
2026-09-11
Last reviewed
2026-09-11
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
veterinary services
Detection rules
9
Indicators of compromise
13

Malware and tooling in Platform-Aware Phishing Kits Fingerprint Devices to Deliver

Malware and tooling: Ave Maria, Ave Maria Stealer (WarzoneRAT), Ninite Loader, Comodo/Itarian-domain-blended RMM channel, ConnectWise RAT (ScreenConnect), Itarian RAT (Comodo Remote Access), ScreenConnect

Cofense Intelligence documents phishing kits that fingerprint a victim's browser/OS/language/timezone/screen/geolocation from a single landing page and branch the payload: Windows victims receive an installer (e.g. GoogleMeet_Ti.msi) that deploys the legitimate remote-management tools ConnectWise RAT (ScreenConnect) or Itarian RAT (Comodo), sometimes via a Ninite Loader staging step, while macOS and Android victims are redirected to credential-harvesting pages spoofing Google, DocuSign, Microsoft Teams, Adobe, and Zoom.

How Platform-Aware Phishing Kits Fingerprint Devices to Deliver works

Cofense Intelligence's 2026-07-01 report "The Platform You Trust Is the Platform They Target" (authored by Max Gannon) describes an evolution from one-size-fits-all phishing toward platform-aware kits that adapt payload delivery to the victim's device. A single spearphishing link (or, in a simpler baseline variant, a malicious script archive attachment) leads to a landing page that runs a client-side fingerprinting script collecting browser User-Agent, operating system, browser type, language, local time and timezone, screen/window dimensions, and geolocation. Some operators additionally use Cloudflare User-Agent edge rules to redirect traffic by perceived OS before the victim ever reaches the malicious page.

Based on the fingerprint, the kit branches: Windows victims are served an MSI-based installer (Cofense's example: GoogleMeet_Ti.msi, masquerading as a Google Meet client) that deploys a legitimate remote-monitoring-and-management (RMM) tool repurposed as a remote access trojan -- ConnectWise RAT (ScreenConnect) or Itarian RAT (Comodo). In one documented case (a veterinary-sector target), the chain runs two fingerprinting stages before resolving to either credential phishing or a loader Cofense calls Ninite Loader, which then stages ConnectWise RAT onto the Windows host. macOS and Android victims -- platforms where the same RAT installers do not apply -- are instead redirected to simplified credential-harvesting pages impersonating Google, DocuSign, Microsoft Teams, Adobe, or Zoom login flows to capture email/password pairs directly.

The report contrasts this with a simpler, traditional infection chain (Cofense ATR 389255) that used inconsistent narratives and a malicious script archive attachment to deliver Ave Maria Stealer (aka WarzoneRAT), a commodity credential-stealing RAT with keylogging, browser-credential-store harvesting, and webcam-capture capabilities. Ave Maria/WarzoneRAT was previously disrupted by an FBI/DOJ law-enforcement action in February 2024 (IC3 CSA 240215) but continues to circulate as malware-as-a-service.

Abuse of legitimate RMM software as a post-phish remote access channel is a broader, independently corroborated trend: Cofense's own May 2025 report "New Weapon of Choice" and Red Canary's June 2026 "dual-use dilemma" post both document threat actors increasingly weaponizing signed, trusted tools such as ConnectWise ScreenConnect, NetSupport Manager, and SimpleHelp because their legitimacy and vendor-domain traffic evade both signature-based detection and platform-specific security assumptions. No CVE, exploited vulnerability, or attributed threat actor/group is identified in any of the source reporting; this is a social-engineering and living-off-the-land RMM-abuse operation, not a software vulnerability.

Cofense's stated defensive takeaway is that organizations can no longer assume a given OS or device type is inherently safer, and that campaign-level, AI-clustered detection (the article cites Cofense Vision 3.2) is needed to connect the Windows-RAT and macOS/Android-credential-phishing variants as one operation rather than triaging them as unrelated, platform-siloed emails.

MITRE ATT&CK techniques used in TL-2026-2452

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading

Credential Access

T1056 Input Capture; T1555 Credentials from Password Stores

Collection

T1056 Input Capture; T1125 Video Capture

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1219 Remote Access Tools

stealth

T1218 System Binary Proxy Execution

Initial Access

T1566 Phishing

Reconnaissance

T1592 Gather Victim Host Information

Affected products and versions in Platform-Aware Phishing Kits Fingerprint Devices to Deliver

  • Microsoft — Windows (desktop endpoints)
    Vulnerable versions: All versions -- targeted via social engineering/RMM abuse, not a software vulnerability
  • Apple — macOS
    Vulnerable versions: All versions -- redirected to credential-harvesting pages, not a software vulnerability
  • Google — Android
    Vulnerable versions: All versions -- redirected to credential-harvesting pages, not a software vulnerability

Remediation for Platform-Aware Phishing Kits Fingerprint Devices to Deliver

Patches

  • Not applicable -- no CVE or software vulnerability is involved; remediation is behavioral and RMM-governance control, not patching

Immediate actions

  • Alert on or block unauthorized installation of ConnectWise ScreenConnect and Itarian (Comodo) RMM agents outside approved IT change windows
  • Detect msiexec-launched installers whose embedded product/publisher metadata is spoofed or mismatched (e.g. Google/Meet-branded MSIs such as GoogleMeet_Ti.msi) on endpoints
  • Enforce phishing-resistant MFA on Google, DocuSign, Microsoft Teams, Adobe, and Zoom accounts to blunt the macOS/Android credential-harvesting branch

Workarounds

  • Restrict outbound network access to ConnectWise ScreenConnect and Itarian/Comodo RMM cloud-relay domains to only pre-approved corporate tenant instances

Longer-term hardening

  • Adopt campaign-level phishing detection (AI clustering across related lure variants) rather than per-email or per-platform triage, since this operation deliberately branches by OS to evade platform-siloed defenses
  • Maintain an allowlist of approved RMM/remote-access tool vendors and tenant instances; alert on any RMM installer or session originating outside that allowlist
  • Deploy EDR behavioral detections for keylogging, browser-credential-store access, and webcam/video capture consistent with Ave Maria (WarzoneRAT)-class stealers

Timeline of Platform-Aware Phishing Kits Fingerprint Devices to Deliver

  • MITRE ATT&CK catalogs WarzoneRAT (Ave Maria) as Software S0670, documenting the keylogging, browser-credential-theft, and webcam-capture capabilities later referenced for the stealer payload in this campaign family's traditional variant.
  • Splunk publishes 'Defending the Gates,' detection research on Ave Maria (Warzone) RAT behaviors relevant to the credential-harvesting payload used in the traditional (pre-platform-aware) infection chain.
  • FBI/DOJ disrupt Warzone RAT (Ave Maria) infrastructure per IC3 Cyber Security Advisory 240215, temporarily degrading the malware-as-a-service offering that continues to circulate in phishing kits.
  • Cofense publishes 'New Weapon of Choice,' documenting the broader trend of threat actors hijacking legitimate RMM tools including ConnectWise ScreenConnect as post-phish remote access -- the same abuse pattern used on this campaign's Windows branch.
  • Red Canary publishes 'The dual-use dilemma,' independently corroborating a surge in RMM abuse (ScreenConnect, NetSupport Manager, SimpleHelp) as ransomware/RAT delivery vectors that evade signature-based and platform-specific detection.
  • Security Boulevard syndicates the Cofense report, widening distribution of the platform-aware phishing findings to the broader security community.
  • Cofense Intelligence publishes 'The Platform You Trust Is the Platform They Target,' detailing platform-aware phishing kits (ATRs 389255, 411478, 413111/41211, 413611, 411787) that fingerprint victim devices and branch delivery to ConnectWise RAT/Itarian RAT (via Ninite Loader) on Windows or credential-harvesting pages on macOS/Android.

Sources cited for Platform-Aware Phishing Kits Fingerprint Devices to Deliver

More in phishing

Detection coverage for TL-2026-2452

As of 2026-09-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2452 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats