As ANY.RUN analysis shows, a campaign that initially appears to target Canadians with fake Canada Revenue Agency (CRA) T4 tax documents is actually part of a much broader remote-access campaign spanning 46 countries, with 45% of observed activity associated with the United States.
The attackers impersonate trusted organizations and document types to trick victims into installing legitimate remote management software, giving them remote access to compromised systems.
Part I. Campaign Scope, Impact, and Defense
Threat Overview
This phishing operation’s final goal is the remote control of the victim’s machine. A reusable fake-document kit delivers interchangeable, legitimate RMM software installer, which the attacker then abuses for hands-on access.
Because the payload is signed commercial software, ordinary signature-based antivirus cannot flag it. Its activity resembles ordinary remote administration.
The campaign uses multiple lures, including the US Social Security Administration, Adobe PDF documents, invoices, VAT notices, and shipping communications, allowing the same attack model to target victims across different regions and business contexts.
Campaign Profile
| Attribute | Assessment |
|---|---|
| Threat type | Phishing delivering RMM-as-RAT for living-off-the-land remote access |
| Family | Fake-document-to-RMM kit; the CRA/T4 Word lure is one arm of a broader fmtt font-linked family |
| Severity | High — hands-on-keyboard remote access |
| Sophistication | Capable — kit-based delivery, LOLBin RMM abuse, password-protected archive, Telegram-based victim filtering; built entirely on legitimate signed tooling |
| Payload | Signed RMM installers abused as remote-access trojans; productsare interchangeable and include GoTo Resolve, LogMeIn Rescue, ITarian in this arm; ScreenConnect, ConnectWise in sibling arms |
| Impersonated brands | Canada Revenue Agency / 2025 T4 Form, SSA, VAT/ATO, DocuSign, Adobe PDF, overdue invoices, shipping documents |
| Attribution | Campaign-level based on shareddelivery-kit handwriting; no named threat actor. Whether this is one operator or a shared phishing-as-a-service kit remains unknown |
| Activity window | January 2026 to present; steady 17–33 kit cases per month |
Statistics and Victimology
Two scopes are important here: the CRA/T4 Word arm, with 137 observed cases, and the broader fake-document family, covering 425 kit URLs across 240 hosts and 601 cases with geographic and industry context.
Activity grew from a single observed case in January 2026 to a steady 17–33 cases per month. Because the final payload is legitimate signed RMM software, cases are tracked through shared kit assets rather than malware-family verdicts, which would significantly undercount the campaign.
Geographically, the broader family is US-first, while the CRA/T4 arm is Canada-first. North America accounts for 61% of family cases, but activity spans 46 countries, with 35 contributing 1% or less. Canada represents 16% of the broader family but 33.3% of the CRA/T4 arm, consistent with deliberate targeting around the Canadian tax lure.
Across industries, education, technology, and government appear prominently in both datasets. Technology figures may be influenced by higher security-team submission rates, while the exposure seen in education and government is more consistent with genuine targeting.
Banking, manufacturing, and finance also feature prominently, aligning more closely with the campaign’s invoice and VAT-themed lures.
These figures represent where campaign samples were observed rather than confirmed compromises, so they should be treated as indicators of targeting focus and a proxy for the potential victim population.
What to Take Back to Your SOC Team
For security leaders, the key takeaway is that defenses need to be product-agnostic. This campaign abuses legitimate, signed RMM software and can switch between vendors, so controls built around a specific tool or AV verdict will leave gaps. Ensure your SOC focuses on the delivery chain and unauthorized remote-access activity instead.
- Treat the RMM install itself as a signal, whatever the product. GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, and ITarian have all been abused in this campaign. Detection should focus on how the software reaches the environment, particularly installations originating from new free-hosting domains or compromised WordPress pages, rather than on the RMMproduct itself.
- Build detection around persistent campaign patterns. Disposable Vercel infrastructure rotates rapidly: 94% of 240 observed hosts appeared for only a single day. Instead of relying primarily on domains, prioritize stable kit indicators, including the fmtt / font1.woff2, icons8-microsoft-word-94.png asset, and the secure.html → project/*.zip chain.
- Account for password-protected archive delivery. The campaign pairs fake document pages with password-protected ZIP files and provides the password to the victim, helping payloads evade automated inspection. Mail-layer controls and user awareness should account for this delivery pattern.
- Baseline authorized remote-access tooling. Maintain an inventory of approved RMM products and ensure the SOC can quickly identify unexpected installations or activity.
- Give analysts behavioral and threat context in one investigation workflow. In this analysis, ANY.RUN’s Interactive Sandbox exposed the delivery chain, browser activity, scripts, and network requests, while Threat Intelligence Lookup expanded persistent indicators into the wider campaign.
Part II. Technical Malware Analysis
Introduction
New *.vercel[.]app deployments appear more or less constantly, each only days old.
One of them, fillingconfirmation[.]vercel[.]app, had been registered just one day before it was observed. Vercel suits the operator well: every deployment comes with valid TLS, a trusted domain, and one-command redeployment. All this gives the lures the reputation needed to clear mail filters while remaining cheap enough to abandon at will.
The activity has continued since January 2026 at a steady monthly pace, with 18 to 57 new kit hosts appearing each month. Cloudflare, Kaseya/INKY, and CyberArmor have also reported on this activity, with findings consistent with what follows here.
The delivery chain
The attack begins with a phishing email linking to a disposable *.vercel[.]app page disguised as a legitimate document. The CRA/T4 lure is one example, alongside SSA, VAT, invoice, shipping, and other document-themed variants.
The page redirects to secure.html, which provides an access code and downloads a password-protected ZIP – the payload. Once the victim extracts and runs the VBS script inside, PowerShell downloads and installs a legitimate RMM agent, giving the operator hands-on-keyboard remote access.
The Kit’s Handwriting Revealed via Advanced URL Analysis
Using ANY.RUN’s in-browser data inspection, we reconstructed the full browser-side chain, including DOM changes, redirects, page content, and screenshots of what the victim sees at each stage.
Every deployment ships essentially the same page, byte for byte. Several recurring DOM elements reveal the kit’s distinctive handwriting:
- An empty title.
- A @font-face declaration for font-family:’fmtt’ sourcing url(img/font1.woff2) — the shared font that links the broader family.
- img src=’img/icons8-microsoft-word-94.png’ id=’fd’ alt=’PDF Icon’ — a Word icon persistently mislabeled as “PDF Icon.”
- A #rl red spinner element.
- A three-hop meta-refresh chain: root page → secure.html → project/.zip.
- The recurring “Downloading 2025 T4 Form…” and access-code text.
For additional cover, the kit opens a harmless decoy PDF through legitimate OneDrive infrastructure (1drv[.]ms, onedrive[.]live[.]com, and canadaeast1-mediap[.]svc[.]ms). Its purpose is simply to make the download appear routine to the victim.
Execution behavior
Using Static discovering in ANY.RUN’s Interactive Sandbox, we inspected the VBS script responsible for launching the next stage of the attack.
The chain progresses only after the victim enters the on-page access code. This unlocks a single VBS script that uses FileSystemObject to launch POWERSHELL.EXE and download the next stage.
PowerShell does the rest: it skips the user profile, introduces a sleep delay to evade timing-based analysis, writes binary data to a stream, and downloads and installs the RMM MSI. Once installed, the RMM agent gives the operator live, hands-on-keyboard access to the system.
Evasion
Evasion operates across multiple stages of the delivery chain. The first layer is the archive: project/.zip returns HTTP 200 but remains password-encrypted, leaving automated pipelines with an inert ZIP they cannot open. The VBS inside is extracted and executed only after the victim enters the on-page access code.
The second layer sits in front of payload delivery. The page fingerprints the browser, IP address, and geolocation using FingerprintJS, an hCaptcha challenge, and a “Green Spinner” gate. On some pages, the results are relayed to api.telegram[.]org, allowing the payload to be served only to visitors that pass the checks while filtering out suspected analysis environments.
The PowerShell stage adds timing-based evasion by calling sleep before reaching out for the MSI installer.
HTTP request analysis in ANY.RUN’s Interactive Sandbox made these delivery and evasion flows visible.
Following the network trail revealed a broader, highly distributed infrastructure.
Network Infrastructure
- Delivery infrastructure: The family includes 82 code-identical Vercel apps, each observed for only a single day, alongside GitHub Pages, Netlify, compromised legitimate websites, and throwaway domains. Vercel is particularly useful to the operator because each new deployment inherits valid TLS and domain reputation.
- Payload staging: RMM installers are staged across rotating infrastructure, including Amazon S3, Cloudflare R2, GitHub, DigitalOcean Spaces, gofile[.]io, Dropbox, compromised sites, and raw-IP hosts.
- RMM infrastructure: The remote-access product is interchangeable. At least five legitimate RMM products have appeared across the family, while the delivery chain remains largely unchanged.
The evidence behind each product is uneven, which bounds what any per-product signature can cover:
| RMM product | What backs it | Install / network artifacts measured |
|---|---|---|
| LogMeIn Rescue / Resolve | 46 cases in this arm; captured MSILogMeInResolve_Unattended.msi | Yes — LOGMEINRESCUEmutex on host |
| GoTo Resolve | Dominant product by network telemetry inthis arm | Yes — TLS SNI and DNS togotoresolve[.]com |
| ScreenConnect | 204 family cases, outside this arm | Identified by case tag |
| ConnectWise | 106 family cases, outside this arm | Identified by case tag |
| ITarian | 1 case | No |
Those measured artifacts cover the GoTo and LogMeIn slot only.
The RMM stage is the thinnest layer of evidence in the chain: 20 of the 137 arm cases are observed fetching the MSI, while the rest stop at the password-protected archive, and the same MSI appears in 150 cases index-wide, so it is staged across delivery arms beyond this kit.
Neither the staging host nor the RMM backend identifies the operator. The MSI sits on shared, abused cloud storage, and the backend is each vendor’s own infrastructure, so neither layer establishes that one operator is behind all of it. The delivery kit’s handwriting is what ties the activity together.
The fact that the product in the RMM slot changes between arms is another reason why this slot is the weakest layer for building a durable signature.
Cluster Expansion
The CRA/T4 arm is one part of a broader delivery framework whose document themes, domains, and RMM payloads change while the underlying kit remains stable. The shared fmtt web font (img/font1.woff2) provides a particularly strong pivot into that wider activity.
| Arm | How to recognize it | Payload / behaviour |
|---|---|---|
| CRA/T4 Word on Vercel | icons8-microsoft-word-94.png (id=fd, alt=‘PDF Icon’) +secure.html +project/*.zip on*.vercel[.]app; access-code ZIP | Password-ZIP to VBS to PowerShell to GoToResolve / LogMeInRescue MSI |
| Adobe-PDF / SSA / compromised-WordPress siblings | Same fmtt /font1.woff2 font; paths /pdfviewer-updater/,/admin/ssaa/, /wp-content/file/ | ScreenConnect / ConnectWise / other RMM tooling, plus Telegram victim-filtering |
To determine whether this is a shared phishing-as-a-service kit with several affiliates, we can use Threat Intelligence Lookup for cluster expansion:
The query returns 601 analysis cases across the three indicators (at the time of writing). The font alone links 425 distinct kit URLs across 240 hosts and 155 IPs between February 5 and July 29, 2026, exposing activity well beyond the CRA/T4 arm.
The same fingerprint produced no matches across roughly 46,000 cases from ten unrelated malware families, supporting its use as an operation-specific marker rather than a generic web artifact.
Infrastructure Footprint
The font1.woff2 query provides a direct measure of the family’s delivery infrastructure. Across 174 days, it identified 425 distinct kit URLs on 240 hosts resolving to 155 IPs.
| Measure | Value |
|---|---|
| Distinct kit URLs | 425 |
| Unique hosts serving the kit | 240 |
| Unique resolving IPs | 155 |
| Observation window | 5 February to 29 July 2026 (174 days) |
| Hosts seen within a single day | 225 of 240 (94%) |
| Hosts seen over 3 days or less | 228 of 240 (95%) |
| Longest-lived host | docshared[.]org — 23 days |
| Busiest host | dashboarduat.paynnow[.]com — 45 kit URLs in 11.5 days |
The hosting breakdown shows how this infrastructure is distributed across different host types:
| Hosting type | Hosts | Kit URLs |
|---|---|---|
| Conventional websites (compromised or stood up) | 117 | 257 |
| Vercel —*.vercel[.]app | 82 | 82 |
| Throwaway registrations on cheap TLDs (.vu,.sbs, .cfd, .icu,.top, .one, .cyou,.shop, .online,.site) | 32 | 65 |
| Dynamic DNS (ddnsking[.]com,swoop2[.]me,letsgo2[.]me,net2me[.]me) | 7 | 19 |
| Netlify —*.netlify[.]app | 1 | 1 |
| Backblaze B2 —f004.backblazeb2[.]com | 1 | 1 |
| Total | 240 | 425 |
Push-button deployment platforms account for 83 of the 240 hosts, with Vercel supplying 82 of them. Every Vercel app was observed on exactly one day with exactly one kit URL and was never reused, indicating a one-app-per-lure deployment model that makes domain-level blocking quickly obsolete.
| Lure theme in the Vercelsubdomain | Apps |
|---|---|
| CRA / T4 tax (2025t4ab1109061,crataxsummary1007341,officialsummarybycra) | 27 |
| Generic shared document / file transfer (shared-doc820848110641,newfilesshared) | 25 |
| Invoice / payment / VAT (invoice-49883-due,payment-recelpt) | 8 |
| Adobe / PDF / Flash updater (adobe-upd, pdfviewer-nu,flash-updater) | 7 |
| Streaming / invite / social (liveeventstream,kik2gethernow) | 7 |
| US SSA / social security (socialsecuritystatementreceived0320) | 4 |
| Shipping and logistics (ups-aw,upsawb4290324) | 4 |
| Total | 82 |
New hosts appear at a steady clip, while Vercel deployments arrive in bursts — 23 new apps in March, at the height of Canadian T4 season, and 20 more in July:
| Month (2026) | New hosts | of which Vercelapps | Kit URLs seen |
|---|---|---|---|
| February | 18 | 6 | 29 |
| March | 43 | 23 | 59 |
| April | 45 | 10 | 76 |
| May | 44 | 16 | 115 |
| June | 33 | 7 | 59 |
| July (to 29th) | 57 | 20 | 87 |
| Total | 240 | 82 | 425 |
The infrastructure also splits into two distinct URL patterns. All 83 Vercel and Netlify apps serve the kit directly from /img/font1.woff2, while 110 other hosts use per-recipient paths in the form /ftx/--/.
The embedded Unix timestamps reveal the campaign’s operational tempo: the median link was first observed just 32 minutes after generation, and 77% within 24 hours. This strongly suggests that links are generated per recipient and used almost immediately.
Reputation follows the same divide. Of 425 URLs, 23 were already rated malicious when observed, all hosted on cheap-TLD throwaway domains. None were Vercel apps, suggesting that the platform provides the clean domain reputation the operator’s own disposable domains lack.
Conclusion
This analysis uncovered a 46-country, US-first campaign that abuses legitimate RMM software while rapidly rotating domains, lures, and remote-access products. The more durable detection opportunity lies in the delivery framework: recurring kit patterns and unsolicited RMM installation rather than individual IOCs or product names.
Using ANY.RUN’s Interactive Sandbox, we exposed the full attack chain, from browser activity and redirects to scripts, processes, and network traffic. Threat Intelligence Lookup then turned persistent indicators into pivots for uncovering related infrastructure and expanding the investigation across the wider campaign.
About ANY.RUN
ANY.RUN provides interactive malware analysis and threat intelligence solutions to more than 16,000 organizations and 700,000 security professionals worldwide.
Its Interactive Sandbox helps SOC teams, MSSPs, and threat researchers investigate malware, suspicious files, and URLs in controlled virtual environments. Analysts can observe execution chains, inspect network activity, and uncover malicious behavior in real time to make faster, more confident decisions.
ANY.RUN Threat Intelligence turns data from real-world investigations into actionable threat intelligence, helping security teams enrich alerts, uncover related infrastructure, investigate campaigns, and track evolving threats.
TTPs
| Tactic | Technique (ID) | Description |
|---|---|---|
| Resource Development | Acquire Infrastructure: Web Services (T1583.006) | The operator used 82 one-shot*.vercel[.]appdeployments, one Netlify app, and*.github[.]io pages to host the lure kit. |
| Resource Development | Acquire Infrastructure: Domains (T1583.001) | The operator registered 32 throwaway domains on cheap TLDs and used 7 dynamic-DNS names to serve the same kit. |
| Resource Development | Compromise Infrastructure (T1584) | The operator used compromised legitimate websites — 8 confirmed in this arm, 117 conventional sites family-wide — to serve the icons8-microsoft-word-94.png kit path. |
| Initial Access | Phishing: Spearphishing Link (T1566.002) | The operator used a CRA/T4 spear-phishing email to link victims to a *.vercel[.]app lure page. |
| Execution | User Execution: Malicious File (T1204.002) | The operator used an on-page access code to induce the victim to extract and run the single VBS script. |
| Execution | Command and Scripting Interpreter: Visual Basic / PowerShell (T1059.005 / .001) | The VBS script usedFileSystemObject to launch PowerShell and download the next stage. |
| Defense Evasion | Obfuscated/Encrypted Files: password-protected archive (T1027) | The kit used a password-protectedproject/*.ziprequiring the on-page access code to block automated extraction. |
| Defense Evasion | Virtualization/SandboxEvasion (T1497) | The operator used Telegram-based victim filtering, browser/IP/geo fingerprinting, and sleep timing to evade analysis environments. |
| Command and Control | Ingress Tool Transfer (T1105) | The operator used PowerShell to download the RMM MSI from rotating S3 / R2 / GitHub / gofile / raw-IP staging. |
| Command and Control | Remote Access Software (T1219) | The operator used a signed RMM agent to establish hands-on-keyboard remote access — GoTo Resolve and LogMeIn Rescue inthis arm, ScreenConnect and ConnectWise in sibling arms. |
| Command and Control | Web Service (T1102) | The kit usedapi.telegram[.]orgto filter victims and conditionally deliver the payload. |
IOCs
All indicators are defanged.
Kit handwriting (detection patterns):
– */secure.html on host *.vercel[.]app
– */project/*.zip on host *.vercel[.]app
– *img/font1.woff2 — the family-wide font pivot (425 URLs / 240 hosts)
– Per-recipient path pattern /ftx/<6-char slug>-<10-digit epoch>-<12-hex>/ on non-platform hosts (289 URLs / 110 hosts); the epoch field dates the link’s generation
– DOM: font-family:’fmtt’ + img/font1.woff2 + alt=’PDF Icon’ + “Access code is” text
Lure deployments (representative; 82 Vercel apps observed in total):
– fillingconfirmation[.]vercel[.]app
– sharedconfirmationslip[.]vercel[.]app
– officialsummarybycra[.]vercel[.]app
– 2026t4form17718[.]vercel[.]app
– crataxsummary1007341[.]vercel[.]app
– statemendetailsfilessenderderf[.]netlify[.]app
Throwaway domains carrying a malicious verdict at observation:
– quavix[.]vu
– cevora[.]vu
– xorlira[.]vu
– voretix[.]icu
– wurel[.]sbs
– mornixa[.]cfd
– getdl[.]jorix[.]cyou
– pdfmarchlitestatementsscannedforyou[.]gixar[.]sbs
– reportstastementformarchreviewyourssaast[.]harnivo[.]cfd
Dynamic-DNS kit hosts (attacker-controlled subdomains of legitimate DDNS providers — block the host, not the provider):
– 54511[.]ddnsking[.]com
– dxy43[.]ddnsking[.]com
– dyb32[.]ddnsking[.]com
– 67pon[.]swoop2[.]me
– dcsi23[.]swoop2[.]me
– ssi11[.]letsgo2[.]me
– ddn3[.]net2me[.]me
Captured RMM MSI: – hxxps://commonerdays[.]vercel[.]app/LogMeInResolve_Unattended.msi
Payload staging (attacker-controlled buckets):
– mayteslaadvisorhq[.]s3[.]us-east-2[.]amazonaws[.]com
– openfodervbs4view[.]ams3[.]cdn[.]digitaloceanspaces[.]com
Durable origin IP:
– 46.62.197[.]232:7000
Compromised legitimate sites (kit path only):
– hiltonheadislanddeals[.]com
– gonzalezjaramilloabogados[.]com
– mybcdc[.]ca
– taurusburgerco[.]com[.]au
– ypatellawoffice[.]ca
– electrical-sei[.]com
– herculescalgarymovers[.]ca
– quantechitsolutions[.]com
Kit page content hashes (SHA256):
– 41b731279b1778a9f578e4ed2589f46c4bef32793b292862cf96279a3ead1c41 (lure index page)
– 132d864bb199105d639edb115249302243eafdb0fc21efb86cc6b6c0d49866f0 (secure.html gate page)
– 51f0cc172ced2e90acbc01c2872c697644380e597076350a6b286c96ab7ccb42 (icons8-microsoft-word-94.png asset)
Sources
- Cloudflare Cloudforce One — Vercel-hosted RMM abuse campaign evolves with Telegram C2 for victim filtering — https://www.cloudflare.com/cloudforce-one/research/report/vercel-hosted-rmm-abuse-campaign-evolves-with-telegram-c2-for-victim-filtering/
- Kaseya / INKY — The Vercel incident and the phishing campaigns already hiding in plain sight — https://www.kaseya.com/blog/phishing-campaigns-abusing-vercels-free-hosting-platform/
- CyberArmor — Cybercriminals Abusing Vercel to Deliver Remote Access Malware — https://www.cyberarmor.tech/blog/threat-insight-cybercriminals-abusing-vercel-to-deliver-remote-access-malware
- Red Canary — The dual-use dilemma: Rethinking detection for remote access tool abuse — https://redcanary.com/blog/security-operations/rmm-detection/
- Broadcom / Symantec — RMM Abuse Continues: Malicious LogMeIn Resolve Activity on the Rise — https://www.broadcom.com/support/security-center/protection-bulletin/rmm-abuse-continues-malicious-logmein-resolve-activity-on-the-rise
- Canada Revenue Agency — Recognize a scam — https://www.canada.ca/en/revenue-agency/corporate/scams-fraud/recognize-scam.html
0 comments