A phishing campaign is attempting to trick users into downloading remote monitoring and management (RMM) software like AnyDesk, Atera, and Splashtop, according to researchers at Malwarebytes.
While these tools are legitimate, they can be exploited by threat actors to carry out many of the same functions as malware. These tools may also be less likely to be flagged as malicious by antivirus software.
“The modus operandi of these threat actors involves deceiving employees through sophisticated scams and deceptive online advertisements,” the researchers write. “Unsuspecting employees, misled by these tactics, may inadvertently invite these criminals into their systems. By convincing employees to download and run these seemingly benign RMM applications under the guise of fixing non-existent issues, these fraudsters gain unfettered access to the company’s network.”
The scammers trick users into visiting a phishing site that impersonates the user’s bank.
“We believe victims are first targeted and then contacted via phishing emails or text messages (smishing) based on their position in the company,” the researchers write.
“Attackers could trick them by sending them to a typical phishing page or making them download malware, all of which are good options. However, they are instead playing the long game where they can interact with their victims. Users are directed to newly registered websites that mimic their financial institution. In order to get support, they need to download remote desktop software disguised as a ‘live chat application.’"
The phony live chat application is actually a version of the AnyDesk remote desktop software.
“In this instance they are using a legitimate (although outdated) AnyDesk executable which would not be detected as malicious by security products,” Malwarebytes says. “Running the program will show a code that you can give to the person trying to assist you. This can allow an attacker to gain control of the machine and perform actions that look like they came directly from the user.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Malwarebytes has the story.
Here's how it works:
