Quick Takeaways
- Cybercriminals are using a Microsoft Teams-themed phishing campaign to deliver remote monitoring and management (RMM) tools via fake update pages and concealed PowerShell downloads.
- Attackers are deploying multiple RMM tools simultaneously on infected hosts to establish resilient, persistent remote access, and are actively exploring system details for further exploitation.
- The campaign, called Operation BlueDash, is attributed to a Nigerian threat group and has been active since at least February 2026, utilizing sophisticated infrastructure and GitHub-hosted phishing payloads.
- This attack framework is part of broader schemes, including multi-brand phishing (e.g., Zoom, Microsoft 365) and credential harvesting, highlighting ongoing threats to corporate communication platforms.
Operation BlueDash Uses Fake Teams Updates to Install Malicious Tools
Recently, cybersecurity experts uncovered a new hacking campaign called Operation BlueDash. The attackers send fake Microsoft Teams update messages to trick users. These messages direct victims to a fake website that looks like the real Microsoft Store. Once there, victims are encouraged to download what appears to be an official Teams update. However, in reality, this download secretly installs malicious software.
The malware includes Remote Monitoring and Management (RMM) tools. These tools give hackers remote access to infected computers. In particular, the campaign deploys two main RMM programs: Level RMM and ScreenConnect. The hackers use a script to fetch these tools quietly. They also register infected devices with secret codes controlled by the attackers. This method helps them keep control even if antivirus programs find one of the tools.
By installing multiple RMM programs on the same device, hackers make it harder for defenders to remove them. They also run commands to check the system’s security status. For example, they examine whether the device needs a reboot or if its firewall is active. They look for ways to gain further control by finding out who has administrative rights on the computer. This detailed exploration shows how hackers prepare their next move carefully.
According to cybersecurity analysts, this campaign is linked to a group operating from Nigeria. They estimate this because of the infrastructure used and the code behind these attacks. The hackers have been active since at least February 2026, using various fake websites and repositories on GitHub to hide their activities. These repositories contain the tools and pages used to lure victims and deploy malware.
Furthermore, the hackers seem to run multi-brand schemes, not just focusing on Teams. They also use fake Zoom meeting links to spread their payloads. Their goal is to download remote management agents and register the infected devices to stay connected. This multi-layered approach demonstrates a focus on resilience and persistence in their operations.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Discover archived knowledge and digital history on the Internet Archive.
CyberAttacks-V1
