Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update

Cybersecurity researchers have identified a phishing campaign disguised as a Microsoft Teams update that uses legitimate remote monitoring and management tools. The campaign employs a "secure document" lure to trick victims into updating Teams, directing them to a fake Microsoft Store page. This page claims that an update is required to open a shared document, and the victim is then compromised through the fake update. The campaign, known as Operation BlueDash, delivers Level RMM and ScreenConnect tools to the victim's system. The phishing campaign utilizes compromised web infrastructure to host the counterfeit Microsoft Store page. The goal of the campaign is to gain remote access to the victim's system.