CSuite Phishing Campaign Hijacks Microsoft 365 Sessions to Deploy RMM Tools

Key points

• CSuite phishing targets Microsoft 365 accounts to steal active sessions.
• Attackers deploy RMM tools for persistent remote access and fraud.
• ANY.RUN observed 351 sandbox analyses, 51% from US victims.
• No CVE involved; the campaign relies on credential and token theft.
• Severity is medium, but impact includes account compromise and fraud.

In 2026, a phishing operation known as CSuite has been targeting Microsoft 365 environments. The campaign's goal is to hijack authenticated sessions, allowing attackers to take over accounts without needing passwords. Once inside, they install remote monitoring and management (RMM) software to maintain persistent remote access and facilitate fraud.

The primary victims appear to be organizations using Microsoft 365, with a strong concentration in the United States. According to ANY.RUN, a malware analysis platform, 351 sandbox analyses have been linked to this campaign, and 51% of submissions originated from US-based sources. Microsoft is the vendor whose product is being abused.

Why does this matter? Session theft bypasses traditional password-based defenses and can defeat some multi-factor authentication setups. By deploying RMM tools, attackers gain legitimate-looking remote control, making detection harder. This can lead to data theft, financial fraud, and long-term espionage.

Contextually, no CVE is associated with this activity. The campaign relies entirely on social engineering and token replay rather than software vulnerabilities. While the severity hint is medium, the potential for account compromise and fraud is significant. Organizations should not underestimate the risk.

What to watch: unusual RMM installations, impossible travel alerts, and token replay attempts. Defenders should review conditional access policies, shorten session lifetimes, and enforce phishing-resistant MFA. Threat intelligence feeds should be updated with CSuite indicators.

What to do now

1. Enforce phishing-resistant MFA (e.g., FIDO2) for all Microsoft 365 accounts.
2. Configure conditional access policies to limit session lifetime and require compliant devices.
3. Monitor for anomalous RMM tool installations and unauthorized remote access.
4. Block known malicious domains and IPs from the CSuite campaign via threat intel.
5. Educate users on recognizing credential phishing and session theft attempts.
6. Review and restrict RMM tool usage to approved applications only.
7. Enable alerting for impossible travel and token replay events.

Original source

The Hacker News