Hackers Abuse Legitimate NinjaOne RMM Software to Bypass Traditional Malware Detection

Cybersecuritynews •Tushar Subhra Dutta • June 12, 2026

A newly documented phishing campaign is using a legitimate remote management tool to silently take over victims’ computers, without deploying a single line of traditional malware. Researchers have uncovered an active operation targeting Brazilian organizations, where attackers trick employees into installing a real enterprise software agent that then hands full remote control to the threat […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Exploits NinjaOne RMM to Target Brazilian Organizations A phishing campaign is leveraging a legitimate NinjaOne Remote Monitoring and Management (RMM) agent to gain unauthorized remote access to Brazilian organizations. Attackers are using social engineering tactics in Portuguese to trick employees in finance, procurement, and administrative roles into installing the software. This method allows the attackers to bypass traditional malware detection, as no bespoke malware is deployed. The operation has been confirmed to be active as of June 12, 2026, affecting multiple organizations across Brazil. The attackers exploit familiar business workflows, making the campaign particularly insidious. No specific numbers of affected organizations or individuals have been disclosed in the articles. The current status indicates ongoing exploitation without immediate resolution. Organizations are advised to remain vigilant against such phishing attempts. 3 sources 68

Extracted Entities

Hackers Abuse Legitimate NinjaOne RMM Software to Bypass Traditional Malware Detection

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Tools (1)