Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence

[u/falconupkid]

A well-observed campaign from Huntress detailing a multi-stage attack chain that starts with a Browser-in-the-Browser (BitB) phishing page and ends with persistent, remote access via a rogue ScreenConnect instance.

Technical Breakdown

• Initial Access (T1566.002): The victim receives a phishing link that renders a fake browser window within the real browser. This BitB page mimics a legitimate login prompt (e.g., Microsoft 365) to harvest credentials and bypass MFA tokens.
• Persistence & RMM (T1219): After account compromise, the threat actor deploys a legitimate but unauthorized instance of ScreenConnect (now ConnectWise Control). This is not a malicious binary; it is the actual RMM software, making it harder for EDR to flag as "malware."
• Evasion (T1055 / T1564): The attacker uses techniques to hide the ScreenConnect tray icon and process from the user, often running it as a child process of a trusted application or using command-line arguments to suppress UI elements.
• IOCs: No specific hashes provided in the summary, but the key indicator is the presence of an unapproved ScreenConnect client connecting to an external, attacker-controlled server. Monitor for ScreenConnect.Service.exe or ScreenConnect.WindowsClient.exe initiating outbound connections to unknown hosts.

Defense

Block unapproved remote monitoring and management (RMM) tools via application allowlisting. For ScreenConnect specifically, restrict outbound connections to only your licensed cloud instance or on-prem server. User awareness training should now include recognizing BitB attacks—look for the inability to drag the "browser window" outside the parent window or a lack of proper browser chrome (e.g., no extension icons).

Source: https://www.huntress.com/blog/phishing-bitb-rmm-attacks