Observed phishing URLs delivering RMM payload
Essential information
- Published
- 23/06/2026 21:59
- Modified
- —
- Source / Author
- AlienVault
- Confidence
- 100/100
- Report type(s)
- threat-report
- Labels / Tags
- docusign phishing rmm screenconnect
- Related entities
- 3 indicators, 2 observables, 3 techniques (mitre), 1 malware
Description
ScreenConnect is used in phishing URLs to deliver RMM payload. DocuSign has been observed to be the common theme in these phishing emails.