Browser-in-the-Browser Phishing Delivers Rogue RMM Tools for Persistence

Summary

Threat actors are using Browser-in-the-Browser (BiTB) phishing techniques to trick users into downloading malicious ScreenConnect installers. The campaigns rely on fake Adobe Acrobat update prompts to establish persistent remote access through multiple rogue RMM instances. After gaining access, the attackers deploy defense-evasion binaries designed to conceal malicious activity on compromised endpoints.

Investigation

Huntress SOC analyzed two separate incidents in which phishing emails redirected victims to BiTB pages impersonating legitimate Adobe domains. Investigators found that users were prompted to download fake PDF reader installers that were actually ScreenConnect clients. These clients established service-based persistence and were then used to retrieve additional defense-evasion tools.

Mitigation

Organizations should train users to verify software updates through official vendor channels rather than trusting browser-based prompts. Technical controls should restrict unauthorized RMM installations and monitor unusual ScreenConnect relay connections. Security teams should also alert on suspicious executables launched from user download directories.

Response

If malicious activity is detected, organizations should immediately remove unauthorized ScreenConnect clients and associated artifacts. Responders should search for defense-evasion binaries such as HideCursor.exe and HideUL.exe. A full forensic review should also identify secondary payloads, persistent services, or additional changes introduced through the rogue RMM sessions.

Simulation Execution

• Attack Narrative & Commands: The adversary sends a spearphishing email containing a link to a spoofed login page. The user interacts with a BiTB window, which appears to be a legitimate OAuth prompt but is actually an attacker-controlled site. Upon “authentication,” a small payload is downloaded and executed. This payload initiates a persistent outbound connection to the rogue ScreenConnect relay server relay.goldenmelon.us to establish a remote management session. This action generates the specific network connection event targeted by the detection rule.

• Regression Test Script:

  # Simulation Script: Triggering Rogue ScreenConnect Detection
  # This script simulates the network egress to a known malicious ScreenConnect relay.
  
  $MaliciousRelay = "relay.goldenmelon.us"
  $TargetIP = "144.172.115.59"
  
  Write-Host "[!] Starting Simulation: Connecting to Rogue ScreenConnect Relay..." -ForegroundColor Yellow
  
  # Simulate the network connection via PowerShell to generate telemetry
  try {
      # Attempting connection to the domain mentioned in the detection rule
      $Response = Invoke-WebRequest -Uri "http://$MaliciousRelay" -Method Get -ErrorAction Stop
      Write-Host "[+] Success: Connection established to $MaliciousRelay" -ForegroundColor Green
  }
  catch {
      # Even if the domain doesn't resolve or refuse connection, the attempt generates the DNS/Network telemetry
      Write-Host "[*] Connection attempt completed (Expected if domain is sinkholed or non-existent)." -ForegroundColor Cyan
  }
  
  # Second attempt using the explicit IP to ensure coverage of all IoCs in the rule
  Write-Host "[!] Attempting connection to malicious IP: $TargetIP" -ForegroundColor Yellow
  try {
      $ResponseIP = Invoke-WebRequest -Uri "http://$TargetIP" -Method Get -ErrorAction SilentlyContinue
  }
  catch {
      Write-Host "[*] IP Connection attempt completed." -ForegroundColor Cyan
  }
  
  Write-Host "[!] Simulation Finished." -ForegroundColor Green

• Cleanup Commands:

  # No persistent changes are made by this simulation script. 
  # No cleanup required.