Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update

Hackers can achieve dual control of a compromised PC via a fake Microsoft Teams update, as detailed by The Hacker News. The update installs two remote‑management tools—Level RMM and ScreenConnect—while also dropping the GoGRPC backdoor. The technique is linked to the Operation BlueDash phishing campaign, which fabricates Teams‑update prompts to lure users into granting elevated access. The campaign blends phishing emails that impersonate IT support with vishing phone calls, a pattern described by Sophos and gbhackers.com.

Victims are directed to open a malicious Teams installer or to share screen via Quick Assist, enabling attackers to hijack sessions and install persistent backdoors, as reported by cyberpress.org and Hackread. Microsoft’s telemetry flagged 7.6 billion phishing messages tied to the surge, underscoring the scale of the threat. Security teams are advised to scrutinize any unsolicited Teams update prompts and to verify IT requests through independent channels, per guidance from CyberSecurityNews. Enterprises should also reinforce multi‑factor authentication for remote‑access tools and monitor for abnormal RMM traffic.

Watch for further alerts from Microsoft and for additional Windows‑based ransomware payloads that may piggyback on the same infection chain. The ongoing cyber‑intelligence feeds suggest that attackers may adapt the fake‑update vector to other collaboration platforms, making timely patch management critical.