Cybersecurity experts have uncovered a phishing campaign leveraging fake Microsoft Teams updates to install remote monitoring and management (RMM) tools. Dubbed Operation BlueDash, this attack aims to exploit unsuspecting users by mimicking legitimate software updates.
Phony Microsoft Store Page Delivers Malware
The attack initiates when victims are redirected to a counterfeit Microsoft Store webpage, purportedly requiring an update to Microsoft Teams for accessing a shared document. This bogus page, known as “teamvem[.]com,” facilitates the download of “supportdev.exe,” an executable that silently runs a PowerShell script. This script fetches and installs a legitimate Level RMM tool while establishing connections using a compromised enrollment key.
Additionally, the same script attempts to deploy ConnectWise ScreenConnect, suggesting a strategy to gain persistent remote access by using multiple tools. The usage of RMM tools in malicious campaigns is not unprecedented. Earlier, Microsoft flagged phishing operations that delivered malware like TrustConnect through similar tactics.
Operation BlueDash: Targets and Techniques
ZeroBEC, the cybersecurity firm tracking this operation, attributes it to a threat group based in Nigeria. The group employs a combination of compromised infrastructure, historical code analysis, and GitHub environments to execute its campaigns. The simultaneous deployment of numerous RMM tools aims to ensure continued access, even if one tool is detected and removed.
Once installed, the attackers probe the infected system by executing commands to assess reboot status, encryption measures, firewall configurations, and administrative group memberships. This reconnaissance aids in determining the most effective method for maintaining control over the targeted systems.
Expanding Threats and Defensive Measures
The infrastructure supporting these attacks includes domains like “support[.]berrydev[.]xyz” and GitHub repositories such as “Bluedashltd” and “rustovni.” These resources contain phishing materials, configuration files, and payload delivery mechanisms. Investigations reveal that this campaign has been active since early 2026, with a focus on exploiting popular workplace applications.
In parallel, ZeroBEC has reported on JIVS PhishKit, a tool for harvesting mailbox credentials across platforms like Microsoft 365 and Google Workspace. This kit uses generic phishing pages to capture email addresses and passwords, bypassing advanced security features like multi-factor authentication.
The rise of sophisticated phishing-as-a-service kits like Kratos, recently dismantled by international authorities, underscores the evolving threat landscape. These services enable widespread phishing operations, fueling an ongoing battle between cybercriminals and security professionals.
As cyber threats grow more complex, organizations must enhance their defenses by implementing robust security measures and educating employees on recognizing phishing attempts. Staying informed about these evolving tactics is crucial for safeguarding sensitive information and maintaining cyber resilience.
