Canadian Tax Lure Expands into a 46-Country RMM Campaign
A remote access campaign, initially targeting Canada with fake tax documents, has expanded to 46 countries, with 45% of activity in the US.
Analysis from ANY.RUN reveals that a campaign initially targeting Canadians with fake tax documents is actually part of a broader remote access campaign spanning 46 countries, with 45% of the activity linked to the United States. Attackers impersonate trusted organizations to trick victims into installing legitimate remote management software.
The campaign employs various lures, including fake documents from the US Social Security Administration and invoices, allowing it to target victims across different regions. Security experts emphasize the need for product-agnostic defenses, as the campaign exploits legitimate software to gain unauthorized access to systems.
This synthesis was produced from its source by AI; there is no human editor or manual review step. How we work