RMM Tools Fuel Stealthy Phishing Campaign

Why It Matters

By weaponizing trusted IT management software, the campaign evades many security controls, highlighting a critical shift in attack vectors that threatens enterprise defenses worldwide.

Key Takeaways

• VENOMOUS#HELPER used SimpleHelp and ScreenConnect RMM tools
• Campaign hit 80+ organizations across US, Europe, Latin America
• RMM misuse rose 277% YoY in 2025, now in 25% incidents
• Phishing emails spoof SSA to deliver malicious executables

Pulse Analysis

The rapid rise of remote monitoring and management (RMM) tools as a preferred attack vector reflects a broader industry trend: cybercriminals are gravitating toward legitimate, signed software that blends seamlessly with everyday IT operations. Huntress’ 2025 data shows a 277% year‑over‑year increase in RMM misuse, with these tools now implicated in roughly one‑quarter of all security incidents. This shift undermines traditional detection methods that focus on known malware signatures, forcing defenders to reassess baseline trust models for administrative utilities.

VENOMOUS#HELPER exemplifies the sophistication of this approach. The campaign delivers a convincing Social Security Administration phishing email, prompting victims to download an executable that silently installs SimpleHelp for scripted control and ScreenConnect for interactive desktop sessions. By employing two distinct RMM platforms, attackers ensure redundancy—if one tool is discovered and removed, the other maintains foothold. Targeting appears focused on high‑tier employees, including those with personal email access on corporate devices and individuals handling cryptocurrency assets, suggesting a financially motivated initial‑access broker or ransomware precursor.

Mitigating RMM‑based threats requires a layered strategy. Application whitelisting can block unauthorized installations outright, while robust SIEM and EDR solutions provide visibility into anomalous background actions, such as frequent network checks or cursor‑movement monitoring. Organizations should also cultivate a culture of "cyber paranoia," training staff across all functions to scrutinize unexpected communications, even those that appear to come from trusted government sources. As attackers continue to weaponize legitimate tools, proactive monitoring and strict access controls will be essential to preserve the integrity of enterprise environments.