[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJykBOPeWkA7J-TNrrZC8-eIPmFT-f5qGBCTcZsrVJvU":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":29},"a55e268f-2d6a-4551-a10e-ceadaaa9f94c","Huntress Uncovers Phishing Attacks Using Fake Browser Pages and Rogue RMM Tools","huntress-uncovers-phishing-attacks-using-fake-browser-pages-and-rogue-rmm-tools-f2060a","Huntress researchers have uncovered two phishing attacks that combined convincing fake browser windows with legitimate remote management software to establish persistent access to victims’ devices. Both incidents, observed in August, began with phishing messages directing victims to attacker-controlled websites. The attackers then used a browser-in-the-browser (BiTB) technique to create what appeared to be a legitimate […] The post Huntress Uncovers Phishing Attacks Using Fake Browser Pages and Rogue RMM Tools appeared first on IT Security Guru.","Huntress researchers have identified two phishing campaigns from August that employed a sophisticated Browser-in-the-Browser (BiTB) technique. These attacks presented victims with convincing fake browser windows, leading them to attacker-controlled websites. The attackers then leveraged legitimate Remote Monitoring and Management (RMM) tools, potentially disguised or misused, to gain persistent access to compromised devices.","Phishing attacks use fake browser windows and rogue RMM tools for persistent access.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F09\u002F09\u002Fhuntress-uncovers-phishing-attacks-using-fake-browser-pages-and-rogue-rmm-tools\u002F?utm_source=rss&utm_medium=rss&utm_campaign=huntress-uncovers-phishing-attacks-using-fake-browser-pages-and-rogue-rmm-tools",null,"2026-09-09T14:20:46+00:00","2026-09-09T16:00:36.862173+00:00",7,[17,20,22],{"name":18,"type":19},"Browser-in-the-Browser","product",{"name":21,"type":19},"Remote Monitoring and Management tools",{"name":23,"type":24},"Huntress","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":25,"icon":12,"name":27,"slug":28},"Threat Intelligence","threat-intelligence",[30,35,40,45],{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":41},{"id":42,"icon":12,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":25,"icon":12,"name":27,"slug":28},[],[23,18,21],{"controls":50,"vendors":131},[51,79,108],{"slug":52,"name":53,"problem":54,"products":55},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[56,64,71],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":65,"vendor_name":23,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":80,"name":81,"problem":82,"products":83},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"slug":109,"name":110,"problem":111,"products":112},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[113,119,126],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":114,"product_name":115,"url":117,"description":118},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":109,"product_name":123,"url":124,"description":125},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":65,"vendor_name":23,"vendor_logo":66,"product_slug":127,"product_name":128,"url":129,"description":130},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[132],{"slug":65,"name":23,"logo_path":66,"roles":133},[134],"reported_by",{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":150},"fake-browser-windows-and-rogue-rmm-tools-enable-persistent-phishing-attacks","Fake Browser Windows and Rogue RMM Tools Enable Persistent Phishing Attacks","Attackers used Browser-in-the-Browser (BiTB) phishing techniques to render convincing fake browser windows that tricked users into entering credentials on attacker-controlled sites. Once initial access was achieved, threat actors abused legitimate Remote Monitoring and Management (RMM) tools to establish persistent footholds — a tactic that blends malicious activity into normal IT operations traffic. This matters because RMM tool abuse is increasingly difficult to detect, as these tools are trusted by default in many enterprise environments. The combination of social engineering and living-off-the-land techniques dramatically raises the bar for both user vigilance and security tooling.",[140,141,142,143,144,145,146,147,148,149],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","MITRE ATT&CK T1219: Remote Access Software","MITRE ATT&CK T1566.002: Phishing – Spearphishing Link","NIST CSF DE.CM-1: Network Monitoring",{}]