"The victim was directed through compromised web infrastructure to a counterfeit Microsoft Store page claiming that Microsoft Teams had to be updated before the shared document could be opened," ZeroBEC said.
Operation BlueDash: a Teams-themed phishing chain with a February 2026 pedigree
Researchers at ZeroBEC have named the latest phishing effort Operation BlueDash. The campaign uses a Microsoft Teams-themed lure hosted on a counterfeit store page — the bogus domain observed in the attacks is teamvem[.]com — and the repository history shows the campaign has been active since at least February 2026, when the GitHub repository containing the fake Microsoft Store "update" was created.
ZeroBEC attributed Operation BlueDash with moderate-to-high confidence to a threat actor group operating from Nigeria, based on analysis of infrastructure, code history, and a GitHub environment used to operate the campaigns.
Level RMM, ScreenConnect and a hard-coded enrollment secret
The offensive payload begins with a file named supportdev.exe, an Inno Setup-based loader that launches PowerShell in a hidden window. That PowerShell fetches an official Level RMM installer and registers the endpoint using an attacker-controlled enrollment secret — recorded in the report as LEVEL_API_KEY=GxSCHE8EZwfyYN3iPQHPai8D.
ZeroBEC observed the same PowerShell command also downloading and deploying ConnectWise ScreenConnect in parallel. The simultaneous deployment of multiple legitimate remote monitoring and management (RMM) tools on the same host is described by the researchers as an attempt to establish redundant, persistent remote access: if one program is detected and removed, another may remain.
ZeroBEC explicitly links this pattern to prior abuse of RMM tooling: earlier in the year Microsoft warned that phishing campaigns delivering signed malware called TrustConnect acted as a conduit for ScreenConnect and other RMM programs such as Tactical RMM and MeshAgent.
Infrastructure, GitHub evidence and multi-brand lures
Analysis of the actor's infrastructure shows a chain of domains and repositories. The support host support[.]berrydev[.]xyz points to a GitHub Pages domain, berry4603.github[.]io, and a repository named "Bluedashltd" that contains the phishing source, CNAME configuration, and the SupportDev payload. A second repository under the same GitHub account, "rustovni," hosts a Zoom meeting lure and payload-delivery components.
In the Zoom-themed variant the actors download the Tactical RMM agent from its official GitHub release, install it in the Windows temporary directory, and register the compromised host with an embedded authentication token. ZeroBEC describes the operation as a multi-brand scheme: the underlying collection and deployment infrastructure remains largely intact while the workplace application lure, payload host, and remote management platform are swapped.
Operator checklist, post-compromise reconnaissance, and a detection window
After installing RMM tooling, the actors run a short sequence of reconnaissance commands to determine the host's state: whether the system is pending a reboot, whether the system volume is protected, active firewall profiles, members of the local Administrators group, and the local Administrators group name.
ZeroBEC summarized that pattern: "This sequence suggests a practical operator checklist: determine system state, understand encryption and firewall posture, and identify privileged local users before deciding how to continue." The researchers note this behavior offers defenders a detection opportunity because the commands originate through an unauthorized RMM context rather than an approved IT workflow.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: watch for unauthorized RMM enrollment activity and the specific PowerShell chains that fetch official installers and present embedded tokens or enrollment secrets — the LEVEL_API_KEY string in this campaign is an explicit example of an attacker-controlled registration step.
- Procurement and IT procurement leaders: the campaign underscores the risk of legitimate remote management tools being repurposed for persistence; contract and vendor controls around enrollment tokens, telemetry, and the ability to detect out-of-band agent registrations become practical mitigations.
- End users: training and controls around opening "secure document" lures remain relevant; the attacks use believable workplace application themes (Teams, Zoom) and redirect victims to counterfeit pages so a document cannot be opened until a bogus "update" is installed.
The disclosures arrive alongside other active phishing efforts documented by ZeroBEC — including a May 2026 operation that dropped RMM backdoors via secure-document lures — and a broader credential-harvesting kit the company calls JIVS PhishKit, whose earliest artifact dates to August 21, 2025. Separately, German authorities, in cooperation with U.S. and Indonesian partners, recently took down the Kratos (formerly Sneaky 2FA) PhaaS kit and arrested its alleged developer and technical administrator; that service is estimated to have earned more than €300,000 ($342,000) since 2024 and to have been used by more than 1,800 criminal enterprises, generating roughly 15,000 phishing campaigns per month.
Operation BlueDash underlines a simple, uncomfortable fact: the tools defenders rely on can be turned into the very mechanisms of compromise when attackers control installation and enrollment. A question the facts leave open is whether platform hosts and code-sharing services that appear in repository commit histories and GitHub Pages will act quickly enough to disrupt live campaign infrastructure before operators move the same playbook to a new set of repositories and domains.
