- A phishing campaign codenamed VENOMOUS#HELPER has targeted over 80 organizations, primarily in the U.S., since at least April 2025.
- Attackers use legitimate Remote Monitoring and Management (RMM) tools like SimpleHelp and ScreenConnect to establish persistent, stealthy access to compromised systems.
- The campaign begins with emails impersonating the U.S. Social Security Administration, directing victims to download malware from compromised legitimate websites.
- This operation aligns with a financially motivated Initial Access Broker (IAB) or a ransomware precursor, according to Securonix researchers.
Since at least April 2025, a sophisticated phishing campaign has been targeting organizations, primarily in the U.S., by weaponizing legitimate remote access software to hijack computer systems. Dubbed VENOMOUS#HELPER, this operation has impacted over 80 entities, as detailed in a report shared by Securonix researchers.
However, the attack cleverly begins with emails impersonating the U.S. Social Security Administration. Consequently, victims are tricked into clicking a link that leads to a compromised but legitimate Mexican business website.
This link ultimately delivers a malicious executable from a second attacker-controlled domain. The malware, packaged to look like a document, then installs the SimpleHelp RMM tool as a persistent Windows service.
Meanwhile, the deployed software establishes a robust foothold with a “self-healing watchdog” and frequent system checks. It also uses a legitimate component called “elev_win.exe” to gain powerful SYSTEM-level privileges on the infected machine.
This elevated access allows the attacker to read screens, inject keystrokes, and freely navigate the network. Furthermore, the operators often deploy a second RMM tool, ConnectWise ScreenConnect, as a redundant backup channel.
Researchers noted the campaign shares overlaps with clusters previously tracked by Red Canary and Sophos. The use of dual, signed RMM tools creates a significant challenge for standard antivirus defenses, which see only legitimate software.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
