[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUu1ct-UUGYg9PDyj-4eVFPw5ylLSpjiBnwL_SW_egrk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"9b43db4f-349c-4c49-ab3e-0e2011b6e85d","fake-browser-windows-and-rogue-rmm-tools-enable-persistent-phishing-attacks","a55e268f-2d6a-4551-a10e-ceadaaa9f94c","Fake Browser Windows and Rogue RMM Tools Enable Persistent Phishing Attacks","Attackers used Browser-in-the-Browser (BiTB) phishing techniques to render convincing fake browser windows that tricked users into entering credentials on attacker-controlled sites. Once initial access was achieved, threat actors abused legitimate Remote Monitoring and Management (RMM) tools to establish persistent footholds — a tactic that blends malicious activity into normal IT operations traffic. This matters because RMM tool abuse is increasingly difficult to detect, as these tools are trusted by default in many enterprise environments. The combination of social engineering and living-off-the-land techniques dramatically raises the bar for both user vigilance and security tooling.","**Immediate actions:**\n- Train all users to verify browser URL authenticity and recognize BiTB phishing indicators such as non-interactive address bars or pop-up windows that cannot be moved outside the browser viewport.\n- Audit and restrict which RMM tools are authorized for use in your environment, blocking unapproved or shadow RMM binaries at the endpoint level.\n\n**Long-term improvements:**\n- Implement application allowlisting to prevent unauthorized RMM clients or remote access tools from executing on endpoints.\n- Enforce phishing-resistant MFA (e.g., FIDO2\u002Fpasskeys) across all user accounts to reduce the impact of credential theft from phishing campaigns.\n- Establish a formal acceptable-use policy for RMM tools that includes periodic revalidation of all authorized remote access software.\n\n**Detection measures:**\n- Deploy behavioral detection rules in your SIEM\u002FEDR to alert on RMM tool installations or executions that originate outside of standard IT provisioning workflows.\n- Monitor network traffic for unexpected outbound connections to RMM command-and-control infrastructure using threat intelligence feeds and DNS filtering.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","MITRE ATT&CK T1219: Remote Access Software","MITRE ATT&CK T1566.002: Phishing – Spearphishing Link","NIST CSF DE.CM-1: Network Monitoring",{},"published","2026-09-09T16:22:43.584999+00:00","2026-09-09T16:22:43.252+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F09\u002F09\u002Fhuntress-uncovers-phishing-attacks-using-fake-browser-pages-and-rogue-rmm-tools\u002F?utm_source=rss&utm_medium=rss&utm_campaign=huntress-uncovers-phishing-attacks-using-fake-browser-pages-and-rogue-rmm-tools","huntress-uncovers-phishing-attacks-using-fake-browser-pages-and-rogue-rmm-tools-f2060a","Huntress Uncovers Phishing Attacks Using Fake Browser Pages and Rogue RMM Tools",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":44,"name":45,"slug":46,"description":47,"color":48},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[51,55,59],{"slug":52,"name":53,"problem":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":56,"name":57,"problem":58},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":60,"name":61,"problem":62},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]