Listen to this Post
Introduction: When Familiar Workplace Tools Become Weapons
Cybercriminals are increasingly turning everyday business platforms into powerful attack channels. Microsoft Teams, Zoom, and other collaboration tools are trusted by millions of organizations, making them attractive targets for threat actors seeking to bypass traditional security awareness.
A newly uncovered campaign, known as Operation BlueDash, demonstrates how attackers are moving beyond traditional malware delivery. Instead of immediately dropping obvious malicious files, they are using realistic workplace-themed phishing pages, fake software updates, and legitimate remote management tools to quietly gain control over corporate systems.
The campaign highlights a growing cybersecurity challenge: attackers are abusing tools that organizations already trust. Remote Monitoring and Management (RMM) platforms are designed to help administrators maintain systems, but in the hands of criminals, they can become invisible backdoors capable of providing long-term access.
Fake Microsoft Teams Update Page Used to Deliver Remote Access Malware
Cybersecurity researchers have identified a sophisticated phishing operation that uses fake Microsoft Teams document-sharing notifications to trick victims into installing malicious software.
According to security researchers at ZeroBEC, victims were redirected through compromised web infrastructure to a counterfeit Microsoft Store-style website. The fraudulent page claimed that Microsoft Teams required an urgent update before users could open a shared secure document.
The fake website, hosted at teamvem[.]com, was designed to look legitimate enough to convince employees that they were completing a routine software update.
Instead, victims downloaded a malicious file called supportdev.exe, beginning a stealthy attack chain.
Attack Chain Uses Legitimate RMM Platforms Instead of Traditional Malware
The downloaded executable was built using Inno Setup and acted as a loader. After execution, it silently launched PowerShell in a hidden window.
The PowerShell process then downloaded an official installer for the Level Remote Monitoring and Management (RMM) platform and registered the infected machine using an attacker-controlled enrollment secret.
This technique represents a major shift in cybercrime strategies. Instead of creating custom malware that security tools may detect, attackers are increasingly abusing legitimate administrative software.
Because RMM solutions are commonly used by IT teams, their presence on a machine may appear normal during initial security investigations.
Attackers Deploy Multiple Remote Access Tools for Backup Control
Researchers discovered that the attackers were not relying on only one remote access platform.
The same PowerShell command chain was also observed downloading and installing ConnectWise ScreenConnect, another legitimate remote administration tool.
Deploying multiple RMM solutions provides attackers with redundancy.
If security teams discover and remove one remote access tool, another may remain active, allowing criminals to continue controlling the compromised system.
This approach mirrors techniques used by advanced intrusion groups that maintain multiple communication channels inside victim networks.
Workplace Communication Platforms Become Popular Phishing Targets
The abuse of workplace applications is not a new trend.
Earlier campaigns investigated by Microsoft showed attackers using fake meeting invitations, PDF attachments, and collaboration-related messages to distribute signed malware such as TrustConnect.
That malware was then used as a bridge to install ScreenConnect and other RMM platforms, including Tactical RMM and MeshAgent.
Attackers understand that employees are more likely to trust messages involving familiar business workflows.
A fake Teams document notification feels less suspicious than an unexpected executable attachment from an unknown sender.
Operation BlueDash Shows Signs of Organized Cybercrime Activity
ZeroBEC researchers named this campaign Operation BlueDash and attributed it with moderate-to-high confidence to a threat actor group operating from Nigeria.
The attribution was based on multiple indicators, including:
Infrastructure analysis
Code similarities
Development history
GitHub environments connected to the campaign
The operation demonstrates a professional approach where attackers maintain reusable infrastructure, update phishing templates, and modify delivery methods depending on the target environment.
Attackers Perform Reconnaissance After Gaining Access
After successfully installing RMM tools, attackers were observed performing reconnaissance activities on compromised Windows systems.
The commands executed were designed to understand the environment before launching additional actions.
Researchers observed attackers checking:
Whether the computer was waiting for a reboot
Whether system volumes had protection enabled
Active firewall configurations
Members of the local Administrators group
Names of privileged administrator accounts
This behavior suggests attackers were following a structured checklist to evaluate the value and security posture of each infected machine.
Unauthorized RMM Activity Creates Detection Opportunities
Although RMM tools are legitimate, their unauthorized use creates clear behavioral indicators for defenders.
Security teams should monitor situations where:
New RMM software appears without approval
Administrative tools are installed outside normal IT processes
PowerShell downloads remote installers
RMM enrollment tokens appear unexpectedly
Employees receive fake collaboration platform updates
The difference between legitimate administration and malicious remote access often depends on context.
A known IT administrator installing ScreenConnect through approved procedures is normal.
A random employee installing multiple RMM agents after clicking a Teams document link is a serious warning sign.
GitHub Infrastructure Reveals Long-Term Campaign Development
Further analysis uncovered attacker infrastructure connected to domains such as:
support[.]berrydev[.]xyz
berry4603.github[.]io
Researchers identified a GitHub repository named Bluedashltd, containing phishing page sources, CNAME configurations, and payload delivery components.
The repository history suggests the operation has been active since at least February 2026.
The attackers created fake Microsoft Store pages designed specifically to imitate software update workflows.
This indicates that the campaign was not a quick experiment but rather a maintained operation with ongoing development.
Attackers Expand Beyond Microsoft Teams Using Zoom-Themed Lures
The investigation also uncovered another repository connected to the same GitHub account.
The second campaign used Zoom meeting invitations as the social engineering theme.
While the appearance changed, the core attack method remained similar:
Fake workplace communication
Malicious delivery page
RMM installation
Attacker-controlled registration
In this case, attackers deployed the Tactical RMM agent from an official GitHub release and registered compromised systems using embedded authentication tokens.
The strategy shows that threat actors are building flexible phishing frameworks rather than relying on a single brand.
JIVS PhishKit Expands Email Credential Theft Campaigns
Alongside Operation BlueDash, ZeroBEC researchers also documented another phishing operation called JIVS PhishKit.
Unlike BlueDash, which focuses on remote access, JIVS targets corporate email credentials.
The campaign sends authenticated emails from unrelated external accounts, warning users that their mailbox violated security policies.
Victims are redirected to phishing pages designed to collect usernames and passwords.
The phishing pages can target multiple platforms, including:
Microsoft 365
Google Workspace
cPanel
Roundcube
Zimbra
Credential Theft Campaigns Continue Despite PhaaS Takedowns
The JIVS campaign follows increased law enforcement pressure against phishing-as-a-service operations.
Authorities recently disrupted the Kratos, previously known as Sneaky 2FA, phishing platform and arrested individuals allegedly connected to its operation.
The service reportedly generated more than $300,000 since 2024 and was used by thousands of criminal actors worldwide.
The takedown demonstrates that governments are becoming more aggressive against cybercrime infrastructure, but new phishing ecosystems continue emerging.
What Undercode Say:
The Operation BlueDash campaign represents a dangerous evolution in modern cyberattacks.
Attackers are no longer depending only on traditional malware.
They are weaponizing trust.
A fake Microsoft Teams update is effective because employees already understand Teams as part of their daily workflow.
The attack does not need advanced exploitation techniques when human confidence becomes the entry point.
RMM abuse is one of the most important cybersecurity trends today.
Tools such as ScreenConnect, Tactical RMM, Level, and MeshAgent were created to improve IT management.
However, their legitimacy creates a security challenge.
Traditional antivirus detection focuses heavily on malicious files.
RMM-based attacks bypass that model because the software itself is not dangerous.
The danger comes from unauthorized usage.
Security teams must move from file-based detection toward behavior-based monitoring.
Organizations should ask:
Who installed this remote access tool?
Why was it installed?
Was the activity approved?
Did the installation happen after suspicious communication?
PowerShell remains a critical part of these attacks.
Hidden PowerShell execution, remote downloads, and automatic registration should trigger additional investigation.
Enterprise defenders should implement stronger controls around:
PowerShell logging
Application allowlisting
Privileged account monitoring
RMM software approval processes
Email security filtering
The use of GitHub infrastructure is also significant.
Attackers increasingly use legitimate cloud services because blocking them completely would damage normal business operations.
GitHub Pages, cloud storage, and developer platforms can become temporary attack infrastructure.
The BlueDash campaign also demonstrates the importance of identity security.
Even if malware is avoided, stolen credentials can still provide attackers with access.
Multi-factor authentication, conditional access policies, and phishing-resistant authentication methods remain essential.
Organizations should train employees to question urgent update requests.
Software updates should come from official application mechanisms, not links received through email or chat messages.
The future of cyber defense will require understanding attacker behavior rather than simply identifying malicious code.
Criminal groups are adapting quickly.
Defenders must adapt faster.
Deep Analysis: Detecting Suspicious RMM Activity With Security Commands
Linux Log Investigation Commands
Although the targeted systems are Windows environments, Linux security servers can be used for monitoring and analysis.
Check authentication logs:
sudo grep "authentication" /var/log/auth.log
Monitor suspicious network connections:
sudo netstat -tulpn
Analyze recent system activity:
last -a
Search suspicious processes:
ps aux | grep -i powershell
Windows Defender and PowerShell Investigation Commands
Check PowerShell event logs:
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational"
Find installed applications:
Get-WmiObject Win32_Product
Review running services:
Get-Service
Identify active network connections:
Get-NetTCPConnection
Check local administrators:
Get-LocalGroupMember Administrators
Threat Hunting Commands
Search downloaded executables:
find / -name ".exe" -mtime -1
Check suspicious startup locations:
Get-CimInstance Win32_StartupCommand
Review scheduled tasks:
schtasks /query /fo LIST
Investigate DNS activity:
tcpdump -i eth0 port 53
✅ The Microsoft Teams-themed phishing campaign and RMM abuse techniques are consistent with documented cybersecurity attack methods.
✅ Legitimate RMM platforms such as ScreenConnect and Tactical RMM have previously been abused by threat actors.
✅ Phishing-as-a-service operations remain an active global threat despite law enforcement takedowns.
Prediction
(+1)
RMM-based attacks will continue increasing as criminals prefer legitimate tools that can bypass traditional malware detection.
Organizations will invest more heavily in behavioral detection systems and identity protection.
Workplace collaboration platforms will remain major phishing targets because attackers continue exploiting user trust.
Attackers will likely expand into more business applications, including Slack, Google Workspace, and other enterprise communication platforms.
Security teams may face greater challenges distinguishing legitimate IT activity from malicious remote administration.
Phishing campaigns will become more personalized using AI-generated messages and realistic corporate branding.
▶️ Related Video (80% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.pinterest.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
