Operation BlueDash Phishing Campaign Deploys Level RMM, ScreenConnect and Tactical RMM

ZeroBEC researchers have uncovered a live phishing operation, tracked as Operation BlueDash, that weaponizes a fake Microsoft Teams “secure document” lure to silently enroll victim endpoints into multiple attacker-controlled remote monitoring and management (RMM) platforms, including Level RMM, ScreenConnect, and Tactical RMM.

The attack begins with a phishing email claiming that a document was too large to send directly and was instead shared securely via Microsoft Teams.

Clicking the embedded link routes victims through compromised web infrastructure to a convincing counterfeit Microsoft Store page demanding a “Teams update” before the document can be accessed.

The fake update download, supportdev.exe, is an Inno Setup-based loader. Upon execution, it launches a hidden PowerShell window, retrieves the legitimate Level RMM installer, and silently enrolls the device using an attacker-controlled API key (LEVEL_API_KEY).

The same script attempts a parallel ScreenConnect deployment, establishing a redundant remote access channel if one is interrupted.

Post-enrollment, ZeroBEC recovered PowerShell commands showing hands-on reconnaissance: checks for pending reboots, BitLocker status, Windows Firewall configuration, and local Administrators group membership.

This operational footprint demonstrates active operator assessment rather than basic automated scanning, reflecting broader shifts toward abusing administrative tools similar to recent social engineering tactics seen across enterprise threat landscapes.

Operation BlueDash Phishing Campaign

DNS and GitHub Pages analysis led investigators directly to a public repository (Bluedashltd) containing the phishing site’s source code, CNAME configuration, the SupportDev payload, and 14 commits of development history.

Earlier repository commits show the operation initially wired its fake update button directly to a ScreenConnect installer before evolving into the multi-RMM SupportDev loader in May 2026.

As detailed in ZeroBEC’s Operation BlueDash report, a second connected repository (rustovni) revealed a parallel Zoom-themed campaign utilizing the same fake-update framework.

That branch later shifted to a JScript payload (ZoomInstallerSetup.js) that installs Tactical RMM via an embedded authentication token, connecting to attacker infrastructure at api.investrneent[.]com.

Based on repository ownership continuity, contributor commit patterns, cross-campaign infrastructure overlap, and broader open-source intelligence (OSINT), ZeroBEC attributes Operation BlueDash to a specific Nigeria-based developer group with moderate-to-high confidence. No evidence suggests the GitHub accounts were compromised or repurposed by an unrelated threat actor.

These findings extend Microsoft’s March 2026 report on signed workplace-app impostors deploying ScreenConnect, Tactical RMM, and MeshAgent.

Operation BlueDash adds Level RMM to the observed toolset and provides unprecedented visibility into the operators’ development lifecycleincluding infrastructure rotation across Netlify, GitHub Pages, and Dropbox.

Detection and Defensive Guidance

Defenders and security operation centers should implement the following telemetry rules and monitoring strategies:

• Inno Setup & PowerShell: Monitor for hidden PowerShell instances spawned by unexpected Inno Setup installers or temporary directories.
• Installer Command Parameters: Audit msiexec process command lines containing unauthorized LEVEL_API_KEY parameters.
• Scripting Engine Audits: Track wscript.exe and cscript.exe executions attempting to install RMM agents from temp folders.
• Strict RMM Allowlisting: Maintain strict enterprise allowlists for RMM solutions and correlate unauthorized agent installations with discovery commands querying BitLocker, Windows Firewall, or administrative group membership.
• Credential & Perimeter Defense: Combine endpoint monitoring with perimeter controls to defend against broader credential theft campaigns targeting organizational networks.