A phishing campaign that posed as Microsoft Teams updates used fake secure document lures to install legitimate remote monitoring and management tools on victim systems, according to a technical analysis by ZeroBEC. The campaign, tracked as Operation BlueDash, has been active since at least February 2026 and includes downloads of Level RMM, ConnectWise ScreenConnect and Tactical RMM.
KEY FACTS
- Lure Victims were sent to a fake Microsoft Store page that said Teams needed an update before a shared document could be opened.
- Payload The loader fetched an official Level RMM installer and registered the device with an attacker-controlled enrollment secret.
- Parallel tools The same command also downloaded ConnectWise ScreenConnect, suggesting multiple access paths.
- Infrastructure The operation used GitHub Pages and related repositories to host phishing pages and payload components.
- Targeting The campaign used both Teams and Zoom themes in separate lures.
The report said the phishing chain began with compromised web infrastructure and a counterfeit Teams page on teamvem[.]com. A file named supportdev.exe acted as an Inno Setup-based loader, opened PowerShell in a hidden window and then pulled down the remote access software.
ZeroBEC linked the activity to infrastructure at support[.]berrydev[.]xyz and a GitHub Pages domain tied to repositories that contained the phishing source, CNAME settings and the payload. It said the same account also hosted a Zoom meeting lure that delivered Tactical RMM from an official GitHub release and enrolled the host with an embedded token.
After deployment, the operators were observed checking whether a reboot was pending, whether the system volume was protected, which firewall profiles were active and who belonged to the local Administrators group. The disclosure said those commands suggest the actors were preparing to decide how to proceed on each machine.
ZeroBEC also described a separate credential-harvesting kit called JIVS PhishKit, which used generic session-expired pages to target multiple email platforms. The company said the earliest artifact dated to August 2025.
WHY IT MATTERS
The case shows how phishing kits can use trusted workplace brands to deliver legitimate administration software that may be harder to flag than traditional malware. It also highlights how repeated use of multiple RMM tools can help attackers maintain access even if one program is removed.