What began as a focused RMM phishing campaign, utilizing **Canada Revenue Agency (CRA)** tax forms as bait, has morphed into a sprawling global operation. **ANY.RUN** research indicates the campaign now spans 46 countries, with approximately 45% of observed activity concentrated in the **United States**, making it the primary target. The attackers employ a wide array of deceptive lures, custom-tailored to their targets. These include fake shipping notifications (e.g., **UPS** communications), **Adobe PDF** documents, various tax notices, themes related to the **US Social Security Administration**, and counterfeit invoices. A key characteristic of this campaign is its reliance on rapidly rotated, disposable **Vercel** infrastructure, which significantly complicates tracking and detection efforts. ## US-First Threat with Daily Infrastructure Rotation  The campaign's infrastructure rotation outpaces its attack patterns. **ANY.RUN** researchers identified 425 unique kit URLs across 240 hosts, with a staggering 94% of these observed for only a single day. This rapid turnover makes traditional Indicator of Compromise (IOC) based detection challenging. Delivery mechanisms include platforms like **Vercel**, **GitHub Pages**, **Netlify**, and compromised websites. Payloads are often staged through legitimate cloud services such as **Amazon S3**, **Cloudflare R2**, **GitHub**, **DigitalOcean Spaces**, **Dropbox**, and **GoFile**. Despite the transient infrastructure, researchers found persistent fingerprints that link disparate activities to the same campaign. Shared assets like `font1.woff2`, recurring image resources, and a consistent `secure.html` → `project/*.zip` delivery structure are key identifiers. Top targeted industries include education, technology, and government, with banking, finance, and manufacturing also prominently featured.  The disposable nature of individual domains and RMM products highlights why detection strategies cannot solely rely on malware verdicts, reputation, or isolated IOCs. To effectively counter these threats, Security Operations Center (SOC) teams require access to the full behavioral context behind suspicious activities, enabling them to distinguish legitimate RMM use from malicious abuse. ## Key Detection Takeaways for SOC Teams * **Build a product-agnostic defense:** Focus on the delivery chain and unauthorized remote-access activity, as legitimate software can be abused and switched between vendors, creating visibility gaps. * **Detect around campaign patterns:** Prioritize stable kit indicators like `fmtt / font1.woff2`, `icons8-microsoft-word-94.png` asset, and the `secure.html` → `project/*.zip` chain, rather than relying solely on domains that rotate daily. * **Establish mail-layer controls and raise user awareness:** Implement robust email security and educate users about the risks, especially concerning password-protected archive delivery. * **Give analysts behavioral and threat context:** Tools like **ANY.RUN's Interactive Sandbox** can expose browser activity, scripts, processes, downloads, and network behavior. **Threat Intelligence Lookup** can connect persistent indicators to related infrastructure and cases, providing deeper insights.  As threat actors increasingly combine legitimate software, trusted services, and ephemeral infrastructure, security teams must access and operationalize in-depth threat context to stay ahead.