Skip to navigation

Threat reportPhishingTL-2026-2704

OS-Aware Phishing Kit Fans Fake iCloud Alert into ScreenConnect RMM, Apple ID, and M365 AiTM Harvesters

highACTIVE

A reusable, operator-maintained phishing kit spoofs an iCloud sign-in alert and reads the visitor's User-Agent server-side to silently fork traffic by OS: Windows users are socially engineered into installing a code-signed ScreenConnect RMM client for full interactive access, Apple users are routed to a spoofed iCloud/Apple ID credential page, and Android/Linux users hit a fake Microsoft sign-in page with a live human-operated Telegram AiTM relay that captures and replays MFA codes. First disclosed .

Key facts

IdentifiersTL-2026-2704
Also known asOS-Aware iCloud Phishing Kit, G-MLOGS
SeverityHIGH
First disclosed
Affected productsApple iCloud / Apple ID sign-in; Microsoft Microsoft 365 / Microsoft sign-in portal (spoofed); ConnectWise ScreenConnect (legitimate, code-signed client abused as social-engineered payload)
AttributionG-MLOGS Operator Group (low confidence)
Tools@dswagofficebot (Telegram Bot ID 5958383710), @smokeiT_bot (Telegram Bot ID 6075686319), ScreenConnect
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1036 Masquerading, T1102.002 Bidirectional Communication, T1111 Multi-Factor Authentication Interception, T1204.002 Malicious File, T1219 Remote Access Tools, T1557 Adversary-in-the-Middle, T1566.002 Spearphishing Link, T1567.004 Exfiltration Over Webhook, T1583.001 Domains, T1598 Phishing for Information, T1608.005 Link Target and 1 more in the attack flow
MotivationFINANCIAL
Target regionsunited states of america
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage

As of 2026-09-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2704 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SEG-Bypass Multi-Hop Redirect Chain Abusing Trusted Open Redirect

Detects the three-hop SEG-bypass redirect chain used by the OS-aware iCloud phishing kit: a client hits the abused open-redirect endpoint on the trusted credit-union domain track.rbfcu.org, then within seconds is redirected through the base64-parameter relay globalema.com to the attacker payload server cherylbirch.com (or sibling kit domains). Correlating the trusted-domain hop with the follow-on hop defeats allow-listing-based SEG evasion.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1598, T1608.005, T1566.002
  • Data sources: pan:threat, bluecoat:proxysg, squid:access, zscaler:web
  • Severity: high
  • Confidence: high

Splunk SPL

index=proxy sourcetype IN ("pan:threat","bluecoat:proxysg","squid:access","zscaler:web") url="*track.rbfcu.org*"
| eval hop1_time=_time
| rename src_ip AS client_ip
| join type=inner client_ip max=0 [
    search index=proxy sourcetype IN ("pan:threat","bluecoat:proxysg","squid:access","zscaler:web")
    dest_domain IN ("globalema.com","cherylbirch.com","andersonsin.com","login1.indomesinq.click","indomesinq.click","siskiyoucyclery.com")
    | eval hop2_time=_time
    | rename src_ip AS client_ip
    | fields client_ip hop2_time dest_domain url
  ]
| where hop2_time>=hop1_time AND (hop2_time-hop1_time)<=120
| table client_ip, user, hop1_time, hop2_time, dest_domain, url
| sort - hop2_time

Microsoft KQL

let PhishKitDomains = dynamic(["globalema.com","cherylbirch.com","andersonsin.com","login1.indomesinq.click","indomesinq.click","siskiyoucyclery.com"]);
let Hop1 = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has "track.rbfcu.org"
| project DeviceId, DeviceName, Hop1Time = Timestamp, InitiatingProcessAccountName;
let Hop2 = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any (PhishKitDomains)
| project DeviceId, Hop2Time = Timestamp, RemoteUrl;
Hop1
| join kind=inner (Hop2) on DeviceId
| where Hop2Time between (Hop1Time .. Hop1Time + 2m)
| project DeviceName, InitiatingProcessAccountName, Hop1Time, Hop2Time, RemoteUrl
| sort by Hop2Time asc

Sigma

title: SEG-Bypass Redirect Chain via Trusted Open Redirect to Phishing Kit Domain
id: a1e4f6d2-7b3c-4e91-9a2d-1c5f8e6b0a11
status: experimental
description: Detects proxy traffic hitting the abused track.rbfcu.org open redirect followed shortly by a request to the OS-aware phishing kit's relay/payload domains, indicating SEG-bypass redirect-chain abuse.
references:
    - https://blog.knowbe4.com/inside-os-aware-phishing-kit-profiling-your-device
author: Threadlinqs Team
date: 2026-09-27
tags:
    - attack.reconnaissance
    - attack.t1598
    - attack.initial-access
    - attack.t1566.002
    - attack.resource-development
    - attack.t1608.005
logsource:
    category: proxy
detection:
    hop1:
        cs-host|contains: 'track.rbfcu.org'
    hop2:
        cs-host|contains:
            - 'globalema.com'
            - 'cherylbirch.com'
            - 'andersonsin.com'
            - 'login1.indomesinq.click'
            - 'indomesinq.click'
            - 'siskiyoucyclery.com'
    timeframe: 2m
    condition: hop1 and hop2
falsepositives:
    - Legitimate rbfcu.org tracking-link traffic that does not chain into the observed phishing-kit domains
level: high

Known false positives:

  • Legitimate marketing/tracking traffic through track.rbfcu.org that coincidentally chains to an unrelated domain within the correlation window

Tuning notes: Narrow the correlation window (currently 120s/2m) based on observed proxy latency in the environment; extend the phish-kit domain list from OSINT feeds (community-corroborated siblings indomesinq.click and siskiyoucyclery.com are already included) as new branches of the reusable kit surface.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Anti-Bot Gate and User-Agent-Based OS Traffic Forking · unlock with TL Creds
  • Spoofed Apple ID / iCloud and M365 Credential Harvest With Forced Double-Password Re-Entry · unlock with TL Creds
  • High-Frequency 3-Second Polling to Attacker Backend (Live AiTM Relay Beacon) · unlock with TL Creds
  • DNS Resolution of OS-Aware Phishing Kit Infrastructure (Including Community-Sibling Domains) · unlock with TL Creds
  • ScreenConnect Client Service Installation Granting Interactive Remote Access · unlock with TL Creds
  • MFA Code Entry Followed Immediately by Sign-In From a New/Unrecognized Location (Replayed AiTM Token) · unlock with TL Creds
  • Code-Signed ScreenConnect Installer Delivered via Spoofed DocSend Portal · unlock with TL Creds
  • Endpoint Egress to Telegram Bot API Following Credential-Harvest Page Visit · unlock with TL Creds

Indicators of compromise

As of 2026-09-27, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-2704.

Sample indicators (3 of 18)

  • Domain: cherylbirch[.]com
  • URL: hxxps://track[.]rbfcu[.]org/yz?!=aHROcH
  • File hash: f9a67b861d56beffa0c880ecc90ec8c1fe6b540aec6438783bb60ea094c0aef9

Defanged, TLP:CLEAR. Full set of 18 indicators: unlock with TL Creds.

18 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration

3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

KnowBe4 Threat Labs identified and dismantled an active, architecturally isolated phishing operation that profiles each visitor's operating system at click-time and routes them down one of three independent attack branches from a single email lure. The lure impersonates an Apple iCloud 'new sign-in' security alert, complete with a fabricated device/IP/timestamp, a fake support reference number, and a corporate legal disclaimer, and displays https://account.apple.com while the underlying link actually resolves elsewhere. Clicking the link first passes through a three-hop SEG-bypass redirect chain: an abused open redirect on the legitimate credit-union domain track[.]rbfcu[.]org (exploiting trusted-domain allow-listing), through the intermediate domain globalema[.]com carrying a base64-encoded destination parameter, and finally to the attacker-controlled server cherylbirch[.]com. Before serving content, cherylbirch[.]com runs every request through antibot.php, which fingerprints User-Agent strings associated with Microsoft Defender/ZAP scanners, checks the HTTP Referer header for Outlook SafeLinks rewriting, queries ip-api.com to filter out cloud-sandbox IP ranges, and requires a mouse-move or keypress within 5 seconds to weed out headless browsers (failures are silently bounced to zoom[.]com). Traffic that survives the gate is forked purely on User-Agent: Windows visitors are shown a spoofed DocSend 'secure document' portal that delivers a legitimately code-signed ScreenConnect.ClientSetup.exe installer, granting the operators full interactive remote access to the victim machine without triggering antivirus (SHA-256 f9a67b861d56beffa0c880ecc90ec8c1fe6b540aec6438783bb60ea094c0aef9). Apple visitors (iPhone/iPad/Mac User-Agents) are silently redirected off-domain to andersonsin[.]com, which hosts a spoofed iCloud login page to harvest Apple ID credentials, with the same reusable server infrastructure also hosting Microsoft 365 credential-harvesting templates. Android, Linux, and other visitors are routed to a fake Microsoft sign-in page backed by a live adversary-in-the-middle relay: the moment a victim submits credentials, they are pushed to the operator's Telegram bot (@smokeiT_bot) in real time, and the victim's browser polls the backend every 3 seconds waiting for the human operator's reply, letting the operator steer the victim through additional prompts and capture and replay time-sensitive MFA codes before they expire. Across all branches, a fabricated 'incorrect password' error forces every victim to re-enter their credentials a second time, a low-cost filter that discards typo'd submissions and passes only validated credential pairs downstream. KnowBe4 found the attacker's server had directory listing enabled, exposing the full kit: a small, coordinated five-person Telegram supergroup ('G-MLOGS', channel ID -1003626986152) with a production exfiltration bot (@smokeiT_bot, bot ID 6075686319) and a separate debug/test bot (@dswagofficebot, bot ID 5958383710), operated principally by @jhlee111 (user ID 6156764114, group creator) with @dswag10 ('Babasuwe') handling the live AiTM relay. Telegram bot tokens dating to September 2025 indicate the kit has been operational for 8+ months. The same server hosted unrelated, modular phishing templates for other targets entirely, including a fake Awardco HR-platform login page (iex.html) and additional Microsoft Authenticator, Google, and enterprise SSO harvesting pages, confirming this is plug-and-play, reusable phishing-kit infrastructure rather than a one-off campaign. During the observed 48-hour window (May 5-6, 2026), the kit drove 250+ confirmed human clicks, with Apple devices accounting for 65% of traffic, Windows 28%, and Android/other 7%; of 157 geolocated victims, 150 (over 95%) were located in the United States. The architectural isolation between the three OS branches is itself a novel evasion technique: because each branch is served from functionally separate infrastructure and payload logic, defenders investigating one branch (e.g., the ScreenConnect delivery) are unlikely to independently discover or correlate the other two branches (Apple ID harvesting, Android/Linux AiTM relay), degrading full-picture detection and takedown efforts.

MITRE ATT&CK techniques by tactic:

Stealth

T1027 Obfuscated Files or Information; T1036 Masquerading; T1684.001 Impersonation

Command and Control

T1102.002 Bidirectional Communication; T1219 Remote Access Tools

Credential Access

T1111 Multi-Factor Authentication Interception; T1557 Adversary-in-the-Middle

Execution

T1204.002 Malicious File

Initial Access

T1566.002 Spearphishing Link

Exfiltration

T1567.004 Exfiltration Over Webhook

Resource Development

T1583.001 Domains; T1608.005 Link Target

Reconnaissance

T1598 Phishing for Information

Remediation

Immediate actions

  • Block/sinkhole the identified domains at DNS and web proxy: cherylbirch[.]com, andersonsin[.]com, globalema[.]com, login1.indomesinq[.]click
  • Hunt for and remove any installations of ScreenConnect.ClientSetup.exe matching SHA-256 f9a67b861d56beffa0c880ecc90ec8c1fe6b540aec6438783bb60ea094c0aef9 that were not deployed by authorized IT/RMM administrators
  • Force password resets and re-enrollment of MFA for any user who reported clicking the iCloud sign-in alert lure during May 5-6, 2026
  • Report the abused open-redirect endpoint on track[.]rbfcu[.]org to the domain owner so the redirect can be closed

Workarounds

  • Disable or tightly restrict outbound access to *.telegram.org / Telegram Bot API domains from general end-user network segments where no legitimate business use exists
  • Configure email security gateways to detonate and follow multi-hop redirect chains rather than trusting allow-listed intermediate domains at face value

Longer-term hardening

  • Deploy application allow-listing / EDR policy that blocks unauthorized installation of RMM clients (ScreenConnect, AnyDesk, TeamViewer, etc.) outside change-managed IT deployment channels
  • Implement phishing-resistant, non-relayable MFA (FIDO2/WebAuthn hardware keys) for iCloud/Apple ID, Microsoft 365, and other high-value SSO to eliminate the value of AiTM-captured OTP/push codes
  • Add behavioral detection for User-Agent-conditioned server-side redirect forking and for consumer messaging-app (Telegram) egress traffic from endpoints
  • Audit and restrict open-redirect endpoints on owned/partner web properties that could be abused for SEG-bypass redirect chains

Affected and fixed versions

  • Apple — iCloud / Apple ID sign-in
    Vulnerable versions: N/A - credential phishing targets all Apple ID account holders
  • Microsoft — Microsoft 365 / Microsoft sign-in portal (spoofed)
    Vulnerable versions: N/A - credential phishing targets all Microsoft 365 account holders
  • ConnectWise — ScreenConnect (legitimate, code-signed client abused as social-engineered payload)
    Vulnerable versions: N/A - legitimate signed installer socially engineered onto victim endpoints

Timeline

  • PHP error logs and Telegram bot token creation dates on the attacker's server indicate the phishing kit and its Telegram C2 bots became operational, giving KnowBe4 8+ months of prior activity evidence by the time of analysis.
  • A fabricated 'incorrect password' error forces every victim across all three branches to re-enter their credentials a second time, letting operators discard typo'd submissions and pass only validated credential pairs downstream.
  • Android/Linux/other visitors are routed to a fake Microsoft sign-in page backed by a live AiTM relay: submitted credentials are pushed to the operator's Telegram bot @smokeiT_bot in real time, the victim's browser polls every 3 seconds for the operator's next instruction, and the operator manually captures and relays MFA codes before expiry.
  • Apple/macOS visitors are silently redirected off-domain to locked-ioc-6, which hosts a spoofed iCloud login page harvesting Apple ID credentials on infrastructure that also serves Microsoft 365 credential-harvesting templates.
  • Windows victims are shown a spoofed DocSend secure-document portal that delivers the code-signed locked-ioc-3 installer (SHA-256 locked-ioc-1), granting the operators full interactive remote access without triggering antivirus.
  • locked-ioc-5 inspects the visitor's User-Agent server-side and silently forks the victim into one of three independent branches: Windows to ScreenConnect delivery, Apple (iPhone/iPad/Mac) to locked-ioc-6, and Android/Linux/other to a Microsoft-themed AiTM harvester.
  • Surviving traffic passes through antibot.php, which fingerprints Defender/ZAP User-Agents, checks the HTTP Referer for Outlook SafeLinks, queries locked-ioc-9 for cloud-sandbox IP reputation, and requires mouse/keyboard interaction within 5 seconds, bouncing failures to locked-ioc-10.
  • Clicked links are funneled through a three-hop redirect chain: an abused open redirect on the legitimate credit-union domain track[.]rbfcu[.]org, an intermediate domain locked-ioc-7 carrying a base64-encoded destination, and finally the attacker payload server locked-ioc-5.
  • Mass phishing emails impersonating an Apple iCloud 'new sign-in' security alert begin reaching targets, opening a 48-hour high-volume campaign window (May 5-6, 2026) that produced 250+ confirmed clicks.
  • The 48-hour observed campaign window closes with 250+ confirmed human clicks recorded; 150 of 157 geolocated victims (over 95%) are located in the United States, with Apple devices accounting for 65% of traffic and Windows 28%.
  • KnowBe4 Threat Labs publishes 'Inside the OS-Aware Phishing Kit Profiling Your Device,' disclosing the kit's architecture, the exposed server (directory listing enabled), Telegram operator handles (@jhlee111, @dswag10) and the 'G-MLOGS' supergroup, and evidence of reusable, unrelated phishing templates (e.g., an Awardco HR-platform lure) on the same infrastructure.

Sources cited

Previous and next in phishing

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats