Phishing Campaign Hits 80+ Orgs Using SimpleHelp and ScreenConnect RMM Tools
Since at least April 2025, there has been an active phishing campaign that uses legitimate Remote Monitoring and Management (RMM) software to target several vectors and establish persistent remote access to compromised machines.
According to Securonix, the operation, dubbed VENOMOUS#HELPER, has affected more than 80 organizations, the majority of which are located in the United States. It has overlaps with clusters that Red Canary and Sophos previously tracked; the latter has given it the name STAC6405. The cybersecurity firm claimed that the campaign is consistent with a financially driven Initial Access Broker (IAB) or a ransomware precursor operation, albeit it is unclear who is behind it.
According to a report provided with The Hacker News by researchers Akshay Gaikwad, Shikha S...