Cybersecurity researchers have flagged a Microsoft Teams-themed phishing campaign that employs "secure document" lures to deliver legitimate remote monitoring and management (RMM) tools.
"The victim was directed through compromised web infrastructure to a counterfeit Microsoft Store page claiming that Microsoft Teams had to be updated before the shared document could be opened," ZeroBEC said in a report published last week. The bogus Teams page in question is "teamvem[.]com."
The active download is used to deliver "supportdev.exe," an Inno Setup-based loader that launches PowerShell in a hidden window, fetches an official Level RMM installer, and registers the endpoint using an attacker-controlled enrollment secret ("LEVEL_API_KEY=GxSCHE8EZwfyYN3iPQHPai8D").
The same PowerShell command has been found to download and deploy ConnectWise ScreenConnect in parallel, indicating an attempt to drop multiple RMM tools with an intent to establish persistent remote access.
This is not the first time threat actors have abused RMM tools to their advantage. Earlier this year, Microsoft warned of multiple phishing campaigns that used workplace meeting lures and PDF attachments to distribute signed malware dubbed TrustConnect, which then acted as a conduit for ScreenConnect, along with other RMM programs like Tactical RMM and MeshAgent.
