US Now Top Target in Global Phishing Campaign That Hijacks Remote Access Tools
A phishing operation first spotted using fake Canadian tax notices has spread to 46 countries, with nearly half of all sightings hitting American inboxes.
Key points
- Researchers at ANY.RUN have linked 601 separate cases to a single phishing operation now active in 46 countries.
- The United States accounts for roughly 45% of observed activity, making it the campaign's top target.
- Early lures posed as Canada Revenue Agency tax forms, which led analysts to initially read the operation as Canada-focused.
- Attackers trick victims into installing legitimate remote monitoring and management (RMM) software, which then hands the criminals full control of the computer.
A phishing campaign that researchers first pegged as a Canadian tax scam is far bigger than it looked. It now spans 46 countries, and the United States is taking the heaviest hits.
The finding comes from ANY.RUN, a malware analysis firm whose sandbox is widely used by incident responders. Its analysts connected 601 separate cases to the same operation, with around 45% of that activity tracing back to victims in the US. Canada remains heavily targeted, which is why the operation was misread as regional at first.
The campaign was originally tagged as Canada-focused because the early bait emails carried fake Canada Revenue Agency tax forms. That framing was misleading. The tax lure was one costume among many.
What are the criminals actually doing?
They're tricking people into installing remote access software on their own computers. Once the program is running, the attacker can see the screen, open files and drop further malware, all without setting off the usual alarms.
The software involved isn't itself malicious. Tools like ConnectWise ScreenConnect and AnyDesk are sold to IT departments to fix laptops from a distance. They're collectively called RMM, short for remote monitoring and management. Because these programs are signed by legitimate vendors, antivirus products often wave them through.
That's the trick. The criminals don't need to write clever malware. They just need one employee to click an installer. We covered this exact method on 4 August 2026, when the Smoke#Screen campaign was tricking staff into installing ScreenConnect with the same result: full remote control, invisible to security software. This is the fifth RMM-abuse story Threat Vectr has reported since 23 June 2026.
How does the lure work?
A victim receives an email that looks like a routine business document: a tax notice or a shipping update. The link leads to a PDF or a webpage that offers a small installer. Running it silently sets up the remote access tool and phones home to the attacker.
From there, the operator can steal saved passwords, read email, move to other machines on the network, or hand access off to a ransomware crew.
Where is the campaign hitting hardest?
| Region | Share of observed activity |
|---|---|
| United States | ~45% |
| Canada | Heavily targeted, original focus |
| Other countries | Remainder across 46 total |
| Total cases linked | 601 |
The US share dwarfs any single other country. The rest is distributed across the remaining countries in the 46-nation total.
Should ordinary workers be worried?
Yes, but the defence isn't complicated. If an email asks you to download a small program to view a tax notice or an invoice, stop. Real tax agencies and real suppliers don't work that way.
Ask your IT team before installing anything, even if the software has a familiar name like AnyDesk or ScreenConnect. Those names are exactly what the criminals are counting on.
If you've already run something like that, tell your employer today. Speed matters. The longer the remote session stays open, the more the operator can take.
The pattern here is worth watching. Every case in that 601-case dataset started with a single click on what looked like paperwork. The sophistication is in the social engineering, not the code, which means no antivirus update is going to close this gap.
