CSuite phishing campaign stealing Microsoft 365 sessions and deploying remote-access tools
Campaign
Summary
Hide ▲
Show ▼
The CSuite phishing campaign is stealing Microsoft 365 sessions and deploying ScreenConnect or Action1, creating paths to account takeover, endpoint control, and business fraud. Researchers traced the operation across 351 sandbox analyses, with 51% of submissions coming from the United States. The activity uses business-themed lures such as Adobe, DocuSign, Zoom, Google Meet, Dropbox, and Microsoft 365, and it is most exposed in technology, manufacturing, government, and consulting organizations. The campaign can turn a single phish into persistent access inside victim environments.
Related Happenings
Microsoft Teams adds third-party deepfake detection and impersonation protection for meetings
Security Tool/Service
H score11
First: 08.10.2026 15:08
Last: 08.10.2026 15:08
Sources 1
About this happening:
Microsoft Teams is adding third-party deepfake detection and impersonation protection to meetings, expanding in-call defenses against synthetic media and deceptive ide...
Microsoft Teams adds third-party deepfake detection and impersonation protection for meetings
Security Tool/ServiceAbout this happening: Microsoft Teams is adding third-party deepfake detection and impersonation protection to meetings, expanding in-call defenses against synthetic media and deceptive ide...
Wazza phishkit campaign targeting banking, manufacturing, and government organizations
Campaign
H score33
First: 08.10.2026 13:30
Last: 08.10.2026 13:30
Sources 1
About this happening:
The Wazza phishing campaign is targeting banking, manufacturing, and government organizations across the US, Europe, and Australia, and it is using multi-stage routi...
Wazza phishkit campaign targeting banking, manufacturing, and government organizations
CampaignAbout this happening: The Wazza phishing campaign is targeting banking, manufacturing, and government organizations across the US, Europe, and Australia, and it is using multi-stage routi...
TA419 AI policy impersonation phishing campaign
Campaign
H score36
First: 01.10.2026 17:00
Last: 01.10.2026 17:00
Sources 1
About this happening:
TA419 is a China-nexus espionage campaign that used credential phishing against AI policy experts at U.S. think tanks, universities, and legal sector organizatio...
TA419 AI policy impersonation phishing campaign
CampaignAbout this happening: TA419 is a China-nexus espionage campaign that used credential phishing against AI policy experts at U.S. think tanks, universities, and legal sector organizatio...
MSP360 RMM phishing campaign deploying ScreenConnect
Campaign
H score33
First: 30.09.2026 19:32
Last: 30.09.2026 19:32
Sources 1
About this happening:
A phishing campaign is using deceptive MSP360 RMM installers to establish remote management access on endpoints and then stage ConnectWise ScreenConnect, expanding the...
MSP360 RMM phishing campaign deploying ScreenConnect
CampaignAbout this happening: A phishing campaign is using deceptive MSP360 RMM installers to establish remote management access on endpoints and then stage ConnectWise ScreenConnect, expanding the...
CSuite phishing exposure concentrates in the United States and key sectors
Trend
H score28
First: 30.09.2026 13:45
Last: 30.09.2026 13:45
Sources 1
How related:
ANY.RUN sandbox telemetry shows a clear US concentration in CSuite activity, with 51% of related submissions coming from the United States.
About this happening:
A US-concentrated CSuite phishing pattern is spreading across 351 sandbox analyses, raising the risk of Microsoft 365 compromise and broader business access across exp...
CSuite phishing exposure concentrates in the United States and key sectors
TrendHow related: ANY.RUN sandbox telemetry shows a clear US concentration in CSuite activity, with 51% of related submissions coming from the United States.
About this happening: A US-concentrated CSuite phishing pattern is spreading across 351 sandbox analyses, raising the risk of Microsoft 365 compromise and broader business access across exp...
Timeline
-
30.09.2026 13:45 2 articles · 13d ago
CSuite phishing campaign steals Microsoft 365 sessions and installs ScreenConnect
Campaign Scope UpdateThe CSuite phishing campaign uses business-themed lures built around Adobe, DocuSign, Zoom, Google Meet, Dropbox, and Microsoft 365, then branches into credential-harvesting or device-code phishing that can steal Microsoft 365 access and active sessions or deliver BAT/VBS droppers that install ScreenConnect or Action1 for remote endpoint access. The campaign is most exposed in technology, manufacturing, government, and consulting organizations, and telemetry in the report shows 351 sandbox analyses with 51% of related submissions coming from the United States.
Show sources
- US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access — thehackernews.com — 30.09.2026 13:45
- US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access — thehackernews.com — 30.09.2026 13:45