Operation BlueDash Leverages Fake Teams Update to Deploy RMM Tools
A sophisticated phishing campaign, dubbed Operation BlueDash, impersonates Microsoft Teams updates to trick users into downloading and installing legitimate remote monitoring and management (RMM) tools like Level RMM and ScreenConnect.
Cybersecurity researchers have identified a new phishing campaign, codenamed Operation BlueDash, that is actively distributing legitimate remote monitoring and management (RMM) tools by impersonating Microsoft Teams updates. The campaign employs "secure document" lures within phishing emails, directing victims to a counterfeit Microsoft Store page hosted at "teamvem[.]com." This fake page prompts users to download a malicious "update" file, disguised as a necessary component for opening a shared document.
The downloaded file, "supportdev.exe," is an Inno Setup-based loader. Upon execution, it launches a hidden PowerShell window that fetches an official Level RMM installer from the internet. The installer is then used to register the compromised endpoint with an attacker-controlled enrollment secret, identified as "LEVEL_API_KEY=GxSCHE8EZwfyYN3iPQHPai8D." This allows the attackers to gain remote access and control over the victim's system.
In parallel with the Level RMM deployment, the same PowerShell command has been observed downloading and installing ConnectWise ScreenConnect. The simultaneous installation of multiple RMM tools suggests a deliberate strategy by the threat actors to establish redundant access pathways and enhance the resilience of their foothold on compromised systems. This makes it more difficult for defenders to fully eradicate the attacker's presence if one tool is detected and removed.
Researchers attribute Operation BlueDash with moderate-to-high confidence to a threat actor group operating from Nigeria. This attribution is based on an analysis of the campaign's infrastructure, code history, and a GitHub environment used for its operations. The campaign has been active since at least February 2026, as indicated by commit history in a GitHub repository named "Bluedashltd," which contained the phishing source code and the "SupportDev" payload.
Following the initial deployment of RMM tools, the threat actors have been observed performing reconnaissance on the infected hosts. They execute commands to check the system's reboot status, assess firewall configurations, enumerate members of the local Administrators group, and determine the name of the local Administrators group. This sequence of actions indicates a methodical approach, suggesting the operators are gathering critical information about the system's state and security posture before proceeding with further malicious activities.
This tactic of abusing legitimate RMM tools is not new. Earlier in 2026, Microsoft had warned of similar phishing campaigns that used workplace meeting lures and PDF attachments to distribute malware, which then facilitated the deployment of ScreenConnect and other RMM programs. Operation BlueDash also appears to be part of a broader, multi-brand scheme where the core attack infrastructure remains consistent, but the lures, payload hosting, and specific RMM platforms are varied to evade detection and target different user bases.
In addition to the Teams-themed campaign, analysis of the threat actor's infrastructure uncovered a second GitHub repository containing a Zoom meeting lure. This variant aims to download and install the Tactical RMM agent, registering the compromised host with the attacker using an embedded authentication token. This demonstrates the attackers' adaptability in using various popular applications as social engineering vectors.
The discovery of Operation BlueDash highlights a growing trend of threat actors leveraging legitimate, powerful tools like RMM software for malicious purposes. By using these tools, attackers can achieve persistent remote access, conduct reconnaissance, and potentially deploy further payloads, all while potentially evading traditional security defenses that might flag custom malware but overlook the activity of approved administrative software.
This new report from Cyber Security News details how Operation BlueDash employs a sophisticated social engineering tactic, routing victims through compromised websites to a fake Microsoft Store page designed to mimic a legitimate update prompt. The malicious Inno Setup package, disguised as a Teams update, silently installs both Level RMM and ScreenConnect, ensuring redundant remote access for the attackers and enabling immediate reconnaissance on the compromised system.