# OS-Aware Phishing Kit Fans Fake iCloud Alert into ScreenConnect RMM, Apple ID, and M365 AiTM Harvesters

> A reusable, operator-maintained phishing kit spoofs an iCloud sign-in alert and reads the visitor's User-Agent server-side to silently fork traffic by OS: Windows users are socially engineered into installing a code-signed ScreenConnect RMM client for full interactive access, Apple users are routed to a spoofed iCloud/Apple ID credential page, and Android/Linux users hit a fake Microsoft sign-in page with a live human-operated Telegram AiTM relay that captures and replays MFA codes.

- **Published:** 2026-09-27T00:00:00Z
- **Last reviewed:** 2026-09-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2704
- **ID:** TL-2026-2704
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** G-MLOGS Operator Group
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

KnowBe4 Threat Labs identified and dismantled an active, architecturally isolated phishing operation that profiles each visitor's operating system at click-time and routes them down one of three independent attack branches from a single email lure. The lure impersonates an Apple iCloud 'new sign-in' security alert, complete with a fabricated device/IP/timestamp, a fake support reference number, and a corporate legal disclaimer, and displays https://account.apple.com while the underlying link actually resolves elsewhere. Clicking the link first passes through a three-hop SEG-bypass redirect chain: an abused open redirect on the legitimate credit-union domain track[.]rbfcu[.]org (exploiting trusted-domain allow-listing), through the intermediate domain globalema[.]com carrying a base64-encoded destination parameter, and finally to the attacker-controlled server cherylbirch[.]com. Before serving content, cherylbirch[.]com runs every request through antibot.php, which fingerprints User-Agent strings associated with Microsoft Defender/ZAP scanners, checks the HTTP Referer header for Outlook SafeLinks rewriting, queries ip-api.com to filter out cloud-sandbox IP ranges, and requires a mouse-move or keypress within 5 seconds to weed out headless browsers (failures are silently bounced to zoom[.]com). Traffic that survives the gate is forked purely on User-Agent: Windows visitors are shown a spoofed DocSend 'secure document' portal that delivers a legitimately code-signed ScreenConnect.ClientSetup.exe installer, granting the operators full interactive remote access to the victim machine without triggering antivirus (SHA-256 f9a67b861d56beffa0c880ecc90ec8c1fe6b540aec6438783bb60ea094c0aef9). Apple visitors (iPhone/iPad/Mac User-Agents) are silently redirected off-domain to andersonsin[.]com, which hosts a spoofed iCloud login page to harvest Apple ID credentials, with the same reusable server infrastructure also hosting Microsoft 365 credential-harvesting templates. Android, Linux, and other visitors are routed to a fake Microsoft sign-in page backed by a live adversary-in-the-middle relay: the moment a victim submits credentials, they are pushed to the operator's Telegram bot (@smokeiT_bot) in real time, and the victim's browser polls the backend every 3 seconds waiting for the human operator's reply, letting the operator steer the victim through additional prompts and capture and replay time-sensitive MFA codes before they expire. Across all branches, a fabricated 'incorrect password' error forces every victim to re-enter their credentials a second time, a low-cost filter that discards typo'd submissions and passes only validated credential pairs downstream. KnowBe4 found the attacker's server had directory listing enabled, exposing the full kit: a small, coordinated five-person Telegram supergroup ('G-MLOGS', channel ID -1003626986152) with a production exfiltration bot (@smokeiT_bot, bot ID 6075686319) and a separate debug/test bot (@dswagofficebot, bot ID 5958383710), operated principally by @jhlee111 (user ID 6156764114, group creator) with @dswag10 ('Babasuwe') handling the live AiTM relay. Telegram bot tokens dating to September 2025 indicate the kit has been operational for 8+ months. The same server hosted unrelated, modular phishing templates for other targets entirely, including a fake Awardco HR-platform login page (iex.html) and additional Microsoft Authenticator, Google, and enterprise SSO harvesting pages, confirming this is plug-and-play, reusable phishing-kit infrastructure rather than a one-off campaign. During the observed 48-hour window (May 5-6, 2026), the kit drove 250+ confirmed human clicks, with Apple devices accounting for 65% of traffic, Windows 28%, and Android/other 7%; of 157 geolocated victims, 150 (over 95%) were located in the United States. The architectural isolation between the three OS branches is itself a novel evasion technique: because each branch is served from functionally separate infrastructure and payload logic, defenders investigating one branch (e.g., the ScreenConnect delivery) are unlikely to independently discover or correlate the other two branches (Apple ID harvesting, Android/Linux AiTM relay), degrading full-picture detection and takedown efforts.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1583.001 Domains
- T1608.005 Link Target
- T1566.002 Spearphishing Link
- T1684.001 Impersonation
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1204.002 Malicious File
- T1219 Remote Access Tools
- T1102.002 Bidirectional Communication
- T1557 Adversary-in-the-Middle
- T1111 Multi-Factor Authentication Interception
- T1567.004 Exfiltration Over Webhook

## Sources

- [Inside the OS-Aware Phishing Kit Profiling Your Device](https://blog.knowbe4.com/inside-os-aware-phishing-kit-profiling-your-device)
- [KB4ThreatLabs: PHISH ALERT - The iCloud Sign-In Scare, One Kit to Harvest It All](https://x.com/Kb4Threatlabs/status/2057092157035728962)
- [New OS-Aware Phishing Campaign Targets Windows, Apple, and Android Users](https://www.memesita.com/new-os-aware-phishing-campaign-targets-windows-apple-and-android-users/)
- [KnowBe4 luidt noodklok over nieuwe generatie phishingaanvallen](https://www.dutchitleaders.nl/news/756946/knowbe4-waarschuwt-voor-phishingaanvallen-die-zich-automatisch-aanpassen-aan-slachtoffer)
- [Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update](https://thehackernews.com/2026/07/operation-bluedash-deploys-level-rmm.html)
- [Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access](https://thehackernews.com/2026/08/fake-adobe-and-zoom-updates-install.html)
- [Signed malware impersonating workplace apps deploys RMM backdoors](https://www.microsoft.com/en-us/security/blog/2026/03/03/signed-malware-impersonating-workplace-apps-deploys-rmm-backdoors/)
- [Rogue RMM Abuse: How Attackers Exploit Remote Access Tools](https://www.huntress.com/blog/rogue-rmm-abuse-phishing-persistent-access)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2704