CSuite Phishing Hits US Tech and Government with 51% of 351 Sandbox Cases, Pairing M365 Session Theft and ScreenConnect RMM Installs

The operation splits into parallel tracks after initial contact. One path harvests active M365 tokens through phishing pages mimicking common business tools, enabling mailbox access and internal impersonation. The second delivers lightweight scripts that elevate privileges and deploy legitimate remote-management agents, converting a single click into persistent remote access without custom malware. Sandbox submissions cluster in technology, manufacturing, government, and consulting verticals, with 51 percent originating inside the United States.

This dual outcome expands typical business-email-compromise scope. Stolen sessions allow attackers to monitor payment threads and redirect invoices while RMM tools provide a foothold that survives password resets. Official reporting notes the geographic and sectoral concentration yet supplies no technical attribution data, leaving open whether the activity reflects one coordinated group or multiple actors reusing the same lure templates and commodity tooling.

Security teams must correlate identity telemetry with endpoint process creation events rather than treating phishing and remote-access incidents as separate queues. The absence of independent verification on actor identity or infrastructure reuse means defenders should prioritize behavioral detection of ScreenConnect and Action1 deployments outside approved change windows over waiting for named-threat indicators.