A phishing campaign that uses fake documents to trick victims into installing legitimate remote monitoring and management software has targeted 46 countries, with the United States receiving roughly 45% of all observed activity, according to research published by ANY.RUN. The operation, initially thought to focus on Canada because it used Canada Revenue Agency tax forms as bait, turned out to be a far broader effort. Researchers connected 601 cases to the wider campaign, which adapts its lures to different targets using shipping notifications, Adobe PDFs, tax notices, US Social Security Administration themes, invoices, and other documents.
The campaign's infrastructure rotates at a much faster pace than its attack methods. ANY.RUN researchers identified 425 kit URLs distributed across 240 hosts, with 94% of those hosts observed for only a single day. The operation has relied on Vercel, GitHub Pages, Netlify, compromised websites, and other infrastructure for delivery, while payloads have been staged through services including Amazon S3, Cloudflare R2, GitHub, DigitalOcean Spaces, Dropbox, and GoFile. Education, technology, and government rank among the most heavily targeted industries, with banking, finance, and manufacturing also prominently represented. Despite the rapid infrastructure turnover, the phishing kit leaves more durable fingerprints through shared assets such as font1.woff2, recurring image resources, and the secure.html → project/*.zip delivery structure, which helped researchers link otherwise separate infrastructure to the same campaign.
The report finds that individual domains and RMM products are disposable, while the underlying delivery chain remains more stable. According to the research, "detection cannot depend solely on malware verdicts, reputation, or individual IOCs" because of this dynamic. The analysis emphasizes that SOC teams need access to the full behavioral context behind suspicious activity to detect these patterns and distinguish legitimate RMM use from abuse.
The campaign's reliance on rapidly rotated, disposable infrastructure through services like Vercel makes it harder to track and detect using traditional methods focused on blocking specific domains or IP addresses. Because attackers are combining legitimate software with trusted cloud services and disposable infrastructure, the report explains, security teams face visibility gaps when defenses are built around individual products or vendors that can be switched out. The more stable elements—the phishing kit's shared assets like font files and image resources, along with the consistent delivery chain structure—offer better detection opportunities than the infrastructure itself, which changes daily.
The report recommends that SOC teams build product-agnostic defenses that maintain focus on delivery chain patterns and unauthorized remote-access activity rather than relying only on domains. It advises prioritizing more stable kit indicators, including the fmtt / font1.woff2 file, icons8-microsoft-word-94.png asset, and the secure.html → project/*.zip chain, instead of domains that rotate daily. Security teams should establish mail-layer controls, raise user awareness around password-protected archive delivery, and give analysts behavioral and threat context to expose browser activity, scripts, processes, downloads, and network behavior. The bottom line: as attackers increasingly weaponize legitimate tools and trusted platforms, detection must shift from static indicators to behavioral patterns and delivery chain analysis. Organizations that continue to anchor their defenses primarily around reputation scores and malware signatures will struggle to identify threats that never trigger traditional alarms, while adversaries retain the operational advantage of disposability at scale.