AnyDesk Phishing Attack Uses Scheduled Task Persistence and Artifact Deletion to Evade Detection

Cybersecuritynews •Tushar Subhra Dutta • July 7, 2026

A new phishing campaign is turning a trusted remote access tool into a long term backdoor for espionage. Attackers hide behind fake invoices to slip past email filters, and once inside a network they rely on everyday IT software rather than custom malware, making the intrusion harder to spot. The campaign targets Russian aerospace and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Aerospace Phishing Campaign Uses AnyDesk for Remote Access and Data Exfiltration A spear-phishing campaign targets the aerospace sector, impersonating the Russian research institute VNIIR. Attackers use a spoof domain (vniir-avia.space) to deliver a password-protected RAR archive containing a multi-stage dropper. This dropper installs a portable version of AnyDesk configured for silent remote access and exfiltrates sensitive configuration data via the Blat SMTP utility. The phishing emails feature fake invoices to bypass email filters, and the campaign employs living-off-the-land tactics, utilizing legitimate software to evade detection. Persistence is achieved through a scheduled task named 'Auto apdate' that runs at logon. The campaign's sophistication and use of common IT tools make it a significant threat to organizations in the aerospace industry. 4 sources 71

Extracted Entities

AnyDesk Phishing Attack Uses Scheduled Task Persistence and Artifact Deletion to Evade Detection

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Industries (1)

MITRE ATT&CK (3)

Tools (1)