Cybersecurity researchers have uncovered a sophisticated phishing campaign that weaponizes fake **Microsoft Teams** updates to deploy legitimate Remote Monitoring and Management (**RMM**) tools on unsuspecting targets. ### The Allure of the 'Secure Document' The campaign, detailed by **ZeroBEC**, directs victims through compromised web infrastructure to a counterfeit **Microsoft Store** page. This deceptive page falsely claims that **Microsoft Teams** requires an update before a shared document can be opened. The bogus domain identified in the attacks is "teamvem[.]com."  ### Multi-RMM Deployment for Redundancy The active download from the fake update page delivers "supportdev.exe," an **Inno Setup**-based loader. This loader executes **PowerShell** in a hidden window, which then fetches an official **Level RMM** installer and registers the endpoint using an attacker-controlled enrollment secret. Notably, the same **PowerShell** command has been observed downloading and deploying **ConnectWise ScreenConnect** in parallel. This dual-RMM deployment strategy suggests an intent to establish persistent remote access with built-in redundancy, ensuring continued access even if one RMM tool is detected and removed. ### A Recurring Threat Pattern Abuse of legitimate RMM tools by threat actors is not a new phenomenon. Earlier this year, **Microsoft** issued warnings about phishing campaigns that utilized workplace meeting lures and PDF attachments to distribute signed malware, dubbed **TrustConnect**. This malware then served as a conduit for **ScreenConnect**, **Tactical RMM**, and **MeshAgent**. **ZeroBEC** also documented a similar campaign in May 2026, which involved phishing emails purporting to share secure documents to facilitate the stealthy deployment of RMM backdoors. ### Operation BlueDash: Tracing the Threat Actor The latest set of attacks has been codenamed **Operation BlueDash**. Based on an analysis of infrastructure, code history, and a **GitHub** environment used to operate the campaigns, the email security company attributes the operation with moderate-to-high confidence to a threat actor group operating from Nigeria. After gaining access, the threat actors are observed exploring the compromised host. They run commands to determine system state, check for pending reboots, assess volume protection, measure active firewall profiles, and enumerate local administrator group members.  "This sequence suggests a practical operator checklist: determine system state, understand encryption and firewall posture, and identify privileged local users before deciding how to continue," **ZeroBEC** noted. "It also provides defenders with a behavioral detection opportunity because the commands originate through an unauthorized RMM context rather than an approved IT workflow." ### GitHub as a Launchpad Further investigation into the threat actor's infrastructure ("support[.]berrydev[.]xyz") revealed a **GitHub Pages** domain ("berry4603.github[.]io") and a repository named "Bluedashltd." This repository contained the phishing source, CNAME configuration, and the **SupportDev** payload. The commit history indicates that the campaign has been active since at least February 2026. A second repository, "rustovni," linked to the same **GitHub** account, was found hosting a **Zoom** meeting lure and its associated payload-delivery components. This suggests the threat actors are employing a multi-brand scheme, adapting their workplace application lures while maintaining a consistent core attack methodology. ### Coordinated Credential Harvesting with JIVS PhishKit In a related development, **ZeroBEC** also detailed **JIVS PhishKit**, a coordinated mailbox credential-harvesting campaign. This kit targets multiple users within the same organization with provider-agnostic phishing pages designed to compromise **Microsoft 365**, **Google Workspace**, **cPanel**, **Roundcube**, **Zimbra**, and other email identities. The earliest artifacts associated with this effort date back to August 21, 2025. Unlike traditional clones, the **JIVS PhishKit** presents a generic "Session Expired" form, making it adaptable across various email platforms. While effective at siphoning corporate email addresses and passwords, the kit does not exfiltrate session cookies, **OAuth** tokens, multi-factor authentication (**MFA**) codes, or browser sessions. These disclosures follow the recent takedown of the **Kratos** (formerly **Sneaky 2FA**) phishing-as-a-service (**PhaaS**) kit by German authorities in collaboration with the U.S. and Indonesia. The operation, which earned over €300,000 ($342,000) since 2024, was used by more than 1,800 criminal enterprises to launch approximately 15,000 phishing campaigns per month.