US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access

ANY.RUN researchers traced a US-focused CSuite phishing campaign across 351 sandbox analyses, with 51% of submissions coming from the United States. Technology, manufacturing, government, and consulting organizations showed the highest exposure. By combining Microsoft 365 session theft with remote-access tool deployment, CSuite can turn a phishing incident into broader account compromise, fraud

The report describes a phishing campaign that steals Microsoft 365 sessions and deploys legitimate remote-management tools, based on 351 sandbox analyses with 51% originating from the United States. It does not identify AI as a component of the campaign; the closest allowed category is therefore the fallback category, malicious AI use, although this is only a weak fit. RealGround analysis: AI CISO Advisory and Continuous AI Red Teaming could help assess adjacent identity, SaaS, and agentic-workflow exposure, but the reported activity is primarily conventional phishing and endpoint compromise.