Back Blogs.Sophos

Incident responders, s'il vous plait: Invites lead to odd malware events

Blogs.Sophos • March 30, 2026

A phishing campaign targeting multiple organizations led to RMM installations – but not much else (yet). A threat actor experimenting, or an access-as-a-service attack underway? Categories: Threat Research Tags: STAC6405, infostealer, RMM, Phishing

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Leads to RMM Installations Across Multiple Organizations A phishing campaign has targeted multiple organizations, resulting in the installation of Remote Monitoring and Management (RMM) tools. The attack appears to be an experiment by a threat actor or could indicate an access-as-a-service attack. Currently, there is no significant damage reported, but the situation remains under observation. The campaign has raised concerns among cybersecurity professionals about the potential for future exploitation. Organizations affected have not been specified, and no specific numbers or CVEs have been disclosed. The nature of the malware involved is categorized as an infostealer. The current status indicates that while installations have occurred, the full impact of the attack is yet to be determined. Incident responders are advised to remain vigilant as the situation develops. 2 sources 34

Extracted Entities

Incident responders, s'il vous plait: Invites lead to odd malware events

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Tools (1)