Operation BlueDash lures victims with fake Teams updates to deploy Level RMM

Intelligence Summary

Operation BlueDash uses a Microsoft Teams-themed phishing flow to trick victims into visiting a counterfeit Microsoft Store page. The page claims a Teams update is required to open a shared “secure document.” After the lure, the campaign delivers legitimate remote monitoring and management tooling. The reported payload includes Level RMM and ScreenConnect, enabling attackers to establish remote access. Organizations should review for Teams-related phishing, block suspicious pages, and hunt for RMM/remote access indicators.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics