CSuite Phishing Targets US Firms, Steals Microsoft 365 Sessions and Plants RMM Tools

Researchers at ANY.RUN have detailed a phishing campaign dubbed CSuite that mainly targets organizations in the United States. Their analysis drew on 351 sandbox runs, with 51% of submissions coming from the US. India accounted for another 18%, with additional activity seen in the Philippines, Australia, the United Kingdom, Canada, and elsewhere. Technology, manufacturing, government and administration, and consulting were among the most exposed sectors.

Two branches of one attack

It all begins with familiar business lures built around Adobe, DocuSign, Zoom, Google Meet, Dropbox, and Microsoft 365. In one analyzed case, a forged DocuSign envelope was dressed up in the name of a law firm.

From there the operation splits in two. The first path delivers installers, archives, or lightweight BAT/VBS droppers that install legitimate management tools — such as ScreenConnect or Action1 — handing attackers remote access to the endpoint. In one session, an Adobe-themed lure delivered a BAT file that elevated privileges and installed ScreenConnect, turning a phishing page into remote control of the machine in just a few steps.

The second path goes after identity. Victims are nudged into credential harvesting or a device-code phishing flow designed to capture Microsoft 365 access and active sessions.

Why the incident escalates

Combining the two makes CSuite more dangerous than ordinary phishing: attackers gain control over both business accounts and employee devices. Possible outcomes include mailbox takeover with visibility into payment threads, financial fraud via invoice manipulation and payment redirection, persistent remote access through abused RMM tools after the initial phish, and lateral spread inside the organization under a trusted identity.

The researchers also flagged a useful thread for defenders: the lure pages repeatedly referenced the path /m/js/utils.js. That recurring artifact let them link separate sandbox runs and surface related activity across the campaign.

Their main takeaway is that a siloed response won't work here. The attack moves through the browser, script execution, payload delivery, and remote-access installation, so investigation requires reconstructing the full chain rather than judging it by a single file or domain — and containing stolen sessions and compromised endpoints at the same time.

Source: The Hacker News