Huntress Uncovers Phishing Attacks Using Fake Browser Pages and Rogue RMM Tools
Phishing attacks use fake browser windows and rogue RMM tools for persistent access.
Huntress researchers have identified two phishing campaigns from August that employed a sophisticated Browser-in-the-Browser (BiTB) technique. These attacks presented victims with convincing fake browser windows, leading them to attacker-controlled websites. The attackers then leveraged legitimate Remote Monitoring and Management (RMM) tools, potentially disguised or misused, to gain persistent access to compromised devices.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Huntress?
Get an email when a new story names Huntress, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers used Browser-in-the-Browser (BiTB) phishing techniques to render convincing fake browser windows that tricked users into entering credentials on attacker-controlled sites. Once initial access was achieved, threat actors abused legitimate Remote Monitoring and Management (RMM) tools to establish persistent footholds — a tactic that blends malicious activity into normal IT operations traffic. This matters because RMM tool abuse is increasingly difficult to detect, as these tools are trusted by default in many enterprise environments. The combination of social engineering and living-off-the-land techniques dramatically raises the bar for both user vigilance and security tooling.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.