A large-scale phishing campaign initially believed to target Canadian users via Canada Revenue Agency (CRA) tax form lures has been revealed as a much broader operation spanning 46 countries. The United States has emerged as the top target, accounting for approximately 45% of observed activity. ANY.RUN researchers linked 601 cases to the wider operation. The campaign leverages Remote Monitoring and Management (RMM) tools as part of its attack chain, likely to gain persistent access to victim systems. The use of legitimate tax-related lures adds a layer of social engineering credibility to the attacks. The geographic breadth and volume of cases indicate a well-organized and ongoing threat actor operation.
A phishing campaign initially believed to target Canada (using Canada Revenue Agency tax form lures) was identified as a global operation spanning 46 countries, with 45% of observed activity targeting the United States. ANY.RUN researchers connected 601 cases to the operation. Attackers use fake documents (shipping/UPS communications, Adobe PDFs, tax notices, US Social Security Administration themes, invoices) to trick victims into installing legitimate Remote Monitoring and Management (RMM) software. Infrastructure is rapidly rotated using disposable Vercel deployments, with 425 kit URLs identified across 240 hosts, 94% of which were observed for only a single day. Other delivery infrastructure includes GitHub Pages, Netlify, compromised websites, Amazon S3, Cloudflare R2, GitHub, DigitalOcean Spaces, Dropbox, and GoFile. Despite rapid rotation, persistent fingerprints exist: shared assets such as font1.woff2, recurring image resources (icons8-microsoft-word-94.png), and the secure.html → project/*.zip delivery structure link otherwise separate infrastructure to the same campaign. Payloads are delivered via password-protected archives. Top targeted industries include education, technology, government, banking, finance, and manufacturing.
1. Build a product-agnostic defense: focus on delivery chain and unauthorized remote-access activity rather than specific RMM vendor products, as legitimate software can be abused and switched between vendors. 2. Detect around campaign patterns: prioritize stable kit indicators over rotating domains — specifically monitor for fmtt/font1.woff2, icons8-microsoft-word-94.png asset, and the secure.html → project/*.zip delivery chain. 3. Establish mail-layer controls and raise user awareness, particularly accounting for password-protected archive delivery. 4. Give analysts behavioral and threat context: use interactive sandbox tools to expose browser activity, scripts, processes, downloads, and network behavior. Use threat intelligence lookup tools to connect persistent indicators to related infrastructure. 5. Do not rely solely on malware verdicts, domain reputation, or individual IOCs for detection — individual domains and RMM products are disposable while the underlying delivery chain is more stable. 6. SOC teams should monitor for unauthorized RMM software installation across endpoints, especially in education, technology, government, banking, finance, and manufacturing sectors.
font1.woff2 (shared phishing kit asset), fmtt (phishing kit asset), icons8-microsoft-word-94.png (recurring image resource in phishing kit), secure.html → project/*.zip (delivery chain structure), 425 kit URLs across 240 hosts (94% single-day lifespan), Password-protected archive delivery mechanism
