The campaign is notable for chaining two techniques: stealing Microsoft 365 sessions and deploying remote monitoring and management (RMM) tooling to establish remote access. That combination allows attackers to escalate a single phishing incident into broader account compromise and fraud rather than a one-off credential grab.

Key points from the research:

• 351 sandbox analyses were reviewed to trace the campaign.
• 51% of submissions came from the United States, confirming the US-focused targeting.
• Most exposed sectors: technology, manufacturing, government, and consulting.
• Attack chain combines Microsoft 365 session theft with RMM tool deployment for persistent remote access.

Defenders should treat unusual RMM installations and anomalous Microsoft 365 session activity as high-priority signals, particularly in the sectors listed above. Session tokens can bypass password-based controls, so revoking active sessions and enforcing conditional access matter as much as credential resets.

Source: info@thehackernews.com (The Hacker News)
Has your organization seen unexpected RMM tool installs or suspicious Microsoft 365 session activity that could match this pattern?