Phishing Campaigns Exploit RMM Tools to Sustain Remote Access

Phishing campaigns are leveraging remote monitoring and management (RMM) tools—ITarian (formerly Comodo), PDQ Connect, SimpleHelp, and Atera—to gain and sustain remote access to compromised systems. By disguising malicious installers as legitimate updates to browsers, meeting invitations, and government forms, attackers exploit users’ trust in common IT administration software, according to Red Canary Intelligence and Zscaler threat hunters.

The operation relies on overlays and full-screen iframes that redirect users to fake update prompts, with C2 traffic funnelled to domains such as panelswp[.]com and dragonshop[.]cloud, and payloads including an ITarian MSI signed by Comodo that sideloads rogue libraries to install HijackLoader or DeerStealer. Other lures distribute PDQ Connect or Atera installers via fake meeting software like MicrosoftTeams.msi, or through government-form pages impersonating IRS W-9s or Social Security statements.

Mitigations emphasise monitoring for new RMM binaries, unexpected MSI downloads from unfamiliar domains, and enhanced browser isolation and network egress filtering, including DNS and proxy logs to flag suspicious R2 storage services.