Phishing wave turns trusted IT tools against enterprises
The gist
Attackers are hijacking trusted IT tools and NIST-backed device management to launch a global phishing wave that’s fooling enterprises at scale.
What to know
- NIST’s 2013 and 2016 guidance made centralized device management—including BYOD and telework—the enterprise standard, now exploited by attackers.
- Phishers impersonate IT support to push fake MFA or SSO updates, using real remote management software disguised as innocuous installers—sometimes averaging 100 malicious MSI deliveries per week.
- The late-2026 phishing campaign hit 46 countries with 45% of activity tied to the US and monthly kit detections surging from 1 in January to 1,733 by September.
NIST’s Shift Fuels Attack Surface
Mandating centralized control of both personal and corporate devices, NIST’s guidance transformed once-manual device management into an enterprise-wide, remotely accessible system—laying the groundwork for today’s large-scale exploitation.
NIST’s 2013 guidance explicitly pushed enterprises toward a centralized mobile device management model covering both corporate-owned and personally owned devices, marking a clear shift in baseline practice. On June 21, 2013, NIST published SP 800-124 Revision 1 recommending “centralized management technologies for both corporate and personally owned mobile devices,” replacing “manual device-by-device administration” and binary BYOD thinking with a standardized model built around centralized enrollment, configuration, compliance, and remote management.
That model was reinforced three years later when NIST’s 2016 update formalized how enterprises should handle telework and BYOD, explicitly tying personally owned devices to centralized remote management controls rather than ad hoc exceptions. On 2016-07-01, NIST updated its telework and BYOD guidance to address “personally owned devices used for telework and remote access,” establishing an operational environment where MDM features such as “enrollment, policy enforcement, remote wipe, and compliance monitoring” became standard enterprise controls.
Social Engineering Bypasses Security
Attackers posing as IT support weaponize trust by delivering legitimate-looking remote management tools, making malicious access nearly indistinguishable from routine helpdesk activity.
The mechanism is persuasion first, malware second: Microsoft said attackers “impersonate internal IT support” and tell employees their “passkey, MFA or SSO configuration needs to be updated immediately,” using helpdesk-style social engineering around passkey/MFA/SSO setup to compromise Microsoft 365 identities, while counterfeit setup pages trick users into authorizing attacker-controlled access that persists through legitimate authentication workflows. Microsoft tied that initial-access pattern to Storm-3121 and Storm-3032, with overlap to UNC6671, and said it was feeding extortion operations linked to ShinyHunters, Falcon and Helix—showing how social engineering can convert routine enrollment and support actions into durable footholds without obviously malicious code.
Once that trust is won, attackers can drop real management software in ways that look ordinary: CyberWire Daily reported that “at the peak of the campaign, we were seeing about 100 instances of this per week” where legitimate remote desktop tools were packaged in MSI files and hosted on trusted resources, then renamed to innocuous labels like “W9.2025 MSI.” That camouflage defeats simple blocking—“the easiest or the lowest hanging fruit of this would be blocking the process creation of the 160 different RMM tools,” but because “these MSIs can be staged on any location in the Internet,” denying 160 RMM tools is impractical—and even fooled a law-enforcement customer until investigators asked, “does your IT department call it W9 2025 MSI?” and “do you let your IT folks download it from R2 buckets?”
Global Surge, U.S. at Epicenter
A single phishing campaign rapidly scaled to 46 countries with nearly half of all attacks targeting U.S. organizations, turning isolated incidents into a relentless, multinational threat.
By early September, the abuse had plainly outgrown the profile of a niche intrusion set and become a multinational wave. Analysis described “a 46 country US first RMM campaign” in which “activity spans 46 countries,” tied to a broader fake-document ecosystem with “425 kit URLs across 240 hosts and 601 cases,” while The Hacker News underscored the same breadth in its framing: “US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries,” evidence that the late-2026 activity was geographically expansive rather than a cluster of isolated incidents.
Within that international spread, the United States stood out as the main concentration point, not a secondary spillover market. The campaign “initially appears to target Canadian” users but “is actually part of a much broader remote Access campaign spanning 46 countries with 45% of observed activity associated with the United States,” and its volume also showed a wider surge in detections: the “Activity window January 2026 to present steady 1733 kit cases per month,” after activity “grew from a single observed case in January 2026 to a steady 1733 cases per month.”
