Trusted Platform Abuse: Vercel Hosted RMM Campaign Evolves with Telegram C2

Du'aine Davis

Observed in the wild

• From November 2025 to January 2026, threat actors conducted a widespread phishing campaign targeting enterprise and business users, abusing trusted *.vercel.app domains to deliver unauthorised remote access. Financially themed lures (invoices, shipping notices, legal threats) were used to socially engineer victims into installing legitimate RMM software, granting attackers persistent remote control of compromised hosts.
• The campaign leveraged Vercel‑hosted phishing pages and a Telegram‑based command-and-control gating mechanism to fingerprint visitors and selectively deliver payloads, filtering out sandboxes and researchers. The final payload was GoTo Resolve (LogMeIn), abused as a Living‑off‑the‑Land tool rather than custom malware, enabling stealthy access while evading signature‑based detection.
• Organisations are advised to monitor and scrutinise traffic from trusted hosting platforms (e.g. vercel.app, surge.sh), enforce application control policies to block unauthorised RMM installations, and use Microsoft Defender to detect anomalous RMM behaviour (unexpected installs, outbound connections, persistence).

Vercel-hosted RMM abuse campaign evolves with Telegram C2 for victim filtering | Cloudflare

Du'aine Davis

Employee Monitoring Tools Abused as Ransomware Footholds
Observed in the wild

• In late January and early February 2026, Huntress observed two intrusions where a single threat actor chained Net Monitor for Employees Professional with SimpleHelp to gain control of enterprise environments. These attacks led to hands‑on‑keyboard activity, attempted ransomware deployment (Crazy ransomware), and targeted organisations using legitimate remote‑management tools as part of everyday operations, allowing the attackers to blend into normal administrative behaviour.
• Threat actors exploited Net Monitor’s built‑in pseudo‑terminal for command execution, reconnaissance, and delivering secondary tools. SimpleHelp was deployed as a redundant persistence layer due to its lightweight agent and ability to operate over common ports. The same filenames (e.g., vhost.exe) and shared C2 infrastructure strongly indicate a single operator or group.
• Organisations are advised to monitor for unauthorised installation of employee‑monitoring or RMM tools, especially Net Monitor and SimpleHelp. Organisations should enable strong MFA on all VPN access, as both breaches originated from stolen SSL‑VPN credentials. Defenders should watch for behaviours such as unexpected winpty‑agent.exe activity, suspicious PowerShell‑based SimpleHelp deployments, unusual service/process names, and remote‑command execution patterns.

Employee Monitoring and SimpleHelp Software Abused in Ransomware Operations | Huntress