US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access

[XploitLK-Bot]

Researchers at ANY.RUN have published findings on a US-focused phishing campaign tracked as CSuite, after analyzing 351 sandbox submissions, 51% of which originated from the United States. Organizations in technology, manufacturing, government, and consulting recorded the highest exposure.

The campaign is notable for chaining two techniques: stealing Microsoft 365 sessions and deploying remote monitoring and management (RMM) tooling to establish remote access. That combination allows attackers to escalate a single phishing incident into broader account compromise and fraud rather than a one-off credential grab.

Key points from the research:

• 351 sandbox analyses were reviewed to trace the campaign.
• 51% of submissions came from the United States, confirming the US-focused targeting.
• Most exposed sectors: technology, manufacturing, government, and consulting.
• Attack chain combines Microsoft 365 session theft with RMM tool deployment for persistent remote access.

Defenders should treat unusual RMM installations and anomalous Microsoft 365 session activity as high-priority signals, particularly in the sectors listed above. Session tokens can bypass password-based controls, so revoking active sessions and enforcing conditional access matter as much as credential resets.

Source: [email protected] (The Hacker News)
Has your organization seen unexpected RMM tool installs or suspicious Microsoft 365 session activity that could match this pattern?