Researchers from ZeroBEC disclosed details of the phishing campaign Operation BlueDash, in which attackers use fake Microsoft Teams update pages to deliver legitimate remote monitoring and management (RMM) tools. Victims are redirected via compromised web infrastructure to a counterfeit Microsoft Store page, where they are told they must update Teams before opening a “secure document.” The campaign poses a threat to organizations of any size because it uses legitimate software to obtain persistent remote access, making it harder to detect with standard security tools.
Technical attack chain
According to the researchers, the fake Teams page is hosted on the domain teamvem[.]com. When a user interacts with it, a file named supportdev.exe is downloaded — an Inno Setup–based loader that launches PowerShell in a hidden window. The script downloads the official Level RMM installer and registers the compromised endpoint using an attacker-controlled registration key (LEVEL_API_KEY=GxSCHE8EZwfyYN3iPQHPai8D).
Reportedly, the same PowerShell script simultaneously downloads and installs ConnectWise ScreenConnect. ZeroBEC believes the deployment of multiple RMM tools on a single host is intended to create backup access channels: if one tool is detected and removed, the other continues to operate.
After installing the RMM agents, the operators execute a series of reconnaissance commands:
- Checking the system’s pending reboot status
- Determining the protection status of the system volume (encryption)
- Enumerating active firewall profiles
- Identifying members of the local “Administrators” group and its name
The researchers note that this sequence resembles an “operator checklist”: determine the system state, assess encryption protection and firewall configuration, identify privileged users — and only then decide on further actions.
Infrastructure and multibrand scheme
Analysis of the attackers’ infrastructure revealed the domain support[.]berrydev[.]xyz, linked to the GitHub Pages domain berry4603.github[.]io and the Bluedashltd repository. This repository contains the phishing page source code, the CNAME configuration, and the SupportDev payload. Commit history indicates the campaign has been active since at least February 2026, when the repository with the fake Microsoft Store page was created.
A second repository (rustovni) tied to the same GitHub account is believed to contain a lure in the form of a Zoom meeting invite and payload delivery components. In this variant, a Tactical RMM agent is downloaded from the official GitHub release, installed into the Windows temporary directory, and registers the host using an embedded authentication token.
The presence of variants with different lures (Teams, Zoom) and different RMM platforms (Level RMM, ScreenConnect, Tactical RMM) points to a multibrand scheme: the core operation remains unchanged, while only the corporate application lure, payload delivery host, and remote management platform are swapped out.
Indicators of Compromise
- Domains: teamvem[.]com, support[.]berrydev[.]xyz, berry4603.github[.]io
- File: supportdev.exe (Inno Setup loader)
- Registration key: LEVEL_API_KEY=GxSCHE8EZwfyYN3iPQHPai8D
Context: the trend of abusing RMM tools
Operation BlueDash fits into a persistent trend of using legitimate remote management tools as backdoors. Earlier in May 2026, ZeroBEC documented a similar campaign involving phishing emails about “secure documents” that resulted in stealthy installation of RMM backdoors. The appeal of this approach for attackers is obvious: legitimate software with valid digital signatures is rarely blocked by antivirus tools, and RMM agents provide full-featured remote access, including file transfer, command execution, and desktop control.
JIVS PhishKit: a parallel threat
In parallel with Operation BlueDash, ZeroBEC described the JIVS PhishKit campaign — a coordinated attack aimed at collecting corporate email credentials by targeting several users within the same organization. The distinguishing feature of this kit is a universal phishing page capable of imitating sign-in to Microsoft 365, Google Workspace, cPanel, Roundcube, Zimbra, and other mail systems. Instead of cloning a specific provider, it uses a generic “Session Expired” form.
The phishing messages were sent from an authenticated external sender that was not associated with the target organization, warning of a “policy violation” for the mailbox and redirecting recipients to a PHP page on the corychase[.]org domain. The kit collects only the corporate email address and password — without intercepting session cookies, OAuth tokens, MFA codes, or browser session data. The earliest artifact of the campaign is dated 21 August 2025.
Defense recommendations
- RMM tool control: implement an application allowlisting policy that explicitly defines which RMM platforms are permitted in your environment. Installation of Level RMM, Tactical RMM, or ScreenConnect outside an approved IT process should trigger a high-priority alert.
- PowerShell monitoring: enable Script Block Logging and monitor PowerShell launched in hidden mode (
-WindowStyle Hidden), especially when the parent process is an unknown executable. - IOC blocking: add the specified domains (teamvem[.]com, support[.]berrydev[.]xyz, berry4603.github[.]io, corychase[.]org) to DNS and proxy blacklists.
- Behavioral detection: the sequence of reconnaissance commands (reboot status check, encryption status, firewall profile enumeration, administrator enumeration) executed via an RMM context outside an approved IT process is a reliable behavioral indicator of compromise.
- Employee training: inform staff that Microsoft Teams is updated through built-in mechanisms and never requires downloading updates from external sites or via a “Microsoft Store” link in an email.
- Credential protection: in the context of JIVS PhishKit, ensure MFA is enabled for all corporate email accounts — even if a password is compromised, this will prevent account access.
Organizations should first audit all installed RMM tools on every endpoint and compare them with the list of approved software. Any unauthorized RMM agent is a potential indicator of compromise that warrants immediate investigation, including host isolation and rotation of privileged account credentials on the affected system.
