US Leads Global Remote‑Management Phishing Surge Across Nearly Half of Affected Nations

A recent investigation has revealed that the United States accounts for roughly 45% of activity in a remote‑monitoring‑and‑management (RMM) phishing operation that has compromised organizations in 46 countries. The campaign, initially thought to be focused on Canada because it employed fake Canada Revenue Agency tax forms as bait, is now understood to be a far broader, multi‑nation effort.

Security researchers traced the malicious emails to a network of compromised or spoofed domains that distribute malicious RMM tools. Victims receive seemingly legitimate tax‑related documents that prompt them to open an attachment or click a link, which then installs remote‑access software. Once installed, the attackers can move laterally across a network, exfiltrate data, or deploy additional payloads.

While the use of Canadian tax forms initially led analysts to label the operation as Canada‑centric, deeper telemetry showed a disproportionate concentration of infections in the United States. The data, gathered from honeypots and telemetry from multiple security vendors, indicates that U.S. entities—ranging from small businesses to larger enterprises—have been the primary recipients of the malicious lures.

The campaign’s breadth underscores the growing appeal of RMM tools among cybercriminals. Legitimate RMM solutions are widely used for IT support, but their powerful remote‑control capabilities make them attractive targets for abuse. Attackers often disguise the software as legitimate updates or support requests, leveraging the trust that organizations place in these tools.

Experts warn that the surge in RMM‑based phishing reflects a shift in attacker tactics toward more sophisticated supply‑chain and remote‑access methods. By compromising a single endpoint, adversaries can gain persistent footholds and expand their reach without needing to breach perimeter defenses directly.

Mitigation recommendations include enforcing strict verification of any unsolicited tax documents, implementing multi‑factor authentication for privileged accounts, and maintaining up‑to‑date inventories of authorized RMM solutions. Organizations are also urged to monitor network traffic for anomalous RMM communications and to educate staff about the signs of phishing attempts that exploit familiar government agencies.

As the investigation continues, security firms are collaborating to share indicators of compromise and to develop detection rules that can flag the specific payloads used in this campaign. The broader implication is a call for heightened vigilance across all sectors, especially in the United States, where the concentration of targets suggests that attackers view the market as a lucrative hunting ground for RMM‑facilitated intrusions.