US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries

An RMM phishing campaign initially associated with Canadian targeting due to its use of Canada Revenue Agency (CRA) tax forms as lures has turned out to be part of a broader campaign spanning 46 countries. Around 45% of observed activity was associated with the United States, making it the campaign's top geographic target. ANY.RUN research connected 601 cases to the wider operation, which uses

Report facts: The article describes a remote monitoring and management (RMM)–based phishing campaign leveraging tax-themed lures (including Canada Revenue Agency forms) that has expanded to 46 countries, with about 45% of observed activity targeting the United States. The campaign uses social engineering and legitimate RMM tools to gain persistent remote access to victims’ systems. RealGround analysis: While the report does not explicitly reference AI, such large-scale, geographically diverse phishing operations are increasingly supported by AI-enhanced tooling (e.g., scalable content generation and targeting) and can threaten AI-enabled business workflows that depend on trusted endpoints. Organizations should include AI-assisted phishing and RMM abuse scenarios in continuous red teaming to ensure AI agents and supporting infrastructure are resilient to compromised user devices and accounts.