Security researchers have identified a Microsoft Teams-themed phishing campaign that tricked users into installing legitimate remote monitoring and management tools.
The campaign allegedly used a Microsoft Store page that appeared legitimate, convincing users to download a file called "Level RMM and ScreenConnect via Fake Teams Update".
According to the researchers, the victim was directed through compromised web infrastructure to this counterfeit page, which then delivered the RMM tools.
The Level RMM tool is a legitimate remote monitoring and management solution, but the attackers have repurposed it to carry out their malicious activities.
Researchers have expressed concerns that this campaign highlights the ongoing threat of phishing attacks, particularly those that use legitimate software to trick users.
Microsoft has not publicly commented on the incident, but the company has taken steps to secure its services, including implementing additional security measures to protect users from similar attacks.