Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update

Cybersecurity researchers have flagged a Microsoft Teams-themed phishing campaign that employs "secure document" lures to deliver legitimate remote monitoring and management (RMM) tools. "The victim was directed through compromised web infrastructure to a counterfeit Microsoft Store page claiming that Microsoft Teams had to be updated before the shared document could be opened," ZeroBEC said in

According to multiple reports, Operation BlueDash is a phishing campaign that impersonates Microsoft Teams "secure document" notifications and routes victims through compromised web infrastructure to a counterfeit Microsoft Store page, where a fake Teams update silently installs Level RMM and ConnectWise ScreenConnect on Windows hosts[1][4]. These are legitimate remote monitoring and management tools being repurposed to establish persistent remote access and potential data compromise in targeted organizations[1][4]. From a RealGround perspective, any SaaS collaboration platform or AI-enabled productivity suite that is trusted by employees can become a high-impact lure surface: attackers can use branded update flows and fake app stores to gain long‑lived remote access that bypasses traditional malware detection, then interact with internal systems (including AI agents) as a seemingly legitimate admin. Organizations should continuously red team their SaaS and AI access flows to detect RMM abuse, harden update and app‑store trust models, and monitor for unusual remote management enrollments and ScreenConnect/Level RMM activity initiated under the guise of collaboration or AI tooling.