Hackers Abuse NinjaOne RMM Agent to Gain Remote Access to Brazilian Organizations

Gbhackers •Mayura Kathir • June 12, 2026

An active phishing campaign that weaponizes a legitimate NinjaOne Remote Monitoring and Management (RMM) agent to gain persistent remote access to Brazilian organizations. Rather than relying on bespoke malware, the operators exploit familiar business workflows and Portuguese-language social engineering to trick finance, procurement, accounting and administrative staff into installing a digitally signed NinjaOne agent that […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Exploits NinjaOne RMM to Target Brazilian Organizations A phishing campaign is leveraging a legitimate NinjaOne Remote Monitoring and Management (RMM) agent to gain unauthorized remote access to Brazilian organizations. Attackers are using social engineering tactics in Portuguese to trick employees in finance, procurement, and administrative roles into installing the software. This method allows the attackers to bypass traditional malware detection, as no bespoke malware is deployed. The operation has been confirmed to be active as of June 12, 2026, affecting multiple organizations across Brazil. The attackers exploit familiar business workflows, making the campaign particularly insidious. No specific numbers of affected organizations or individuals have been disclosed in the articles. The current status indicates ongoing exploitation without immediate resolution. Organizations are advised to remain vigilant against such phishing attempts. 3 sources 68

Extracted Entities

Hackers Abuse NinjaOne RMM Agent to Gain Remote Access to Brazilian Organizations

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Tools (1)