Phishing lures enroll PCs in attackers’ MDM tenants, Huntress says

Huntress said on Oct 28 that phishing emails got victims’ computers enrolled in mobile device management tenants that attackers control, and the attackers used them to install ScreenConnect. In one case a fake DocuSign installer carried a Hexnode MDM package, and in another a fake Teams invite enrolled a receptionist’s computer in an attacker’s Rippling tenant. Huntress says neither Hexnode nor Rippling is at fault.

In the Hexnode case, emails with subjects like “ATTN: Official Invitation to Submit Proposal” linked to a download saved as eD0cuSign_Installer.msi, which installed Hexnode’s gateway and agent. The attacker then installed ScreenConnect, which connected to the attacker’s relay. The MSP removed it, but another copy was installed and reconnected to the same relay hours later, and Huntress isolated the computer.

In the Rippling case, an email titled “Re: Tax Planning and Preparation Inquiry” led to a page titled “Calendar” on a lookalike Teams domain. That page redirected to another that helped enroll the computer. About a minute later the computer was registered in Rippling, and its agent was installed with SYSTEM permissions. About 35 minutes after that, the attackers used the MDM to run a ScreenConnect installer.

Huntress says removing the remote access tool doesn’t remove the management path that delivered it, so MDM enrollment should be treated as security-sensitive. The sequence it says to watch for is a lure, then a new MDM enrollment, then a remote access tool install, then traffic to an unfamiliar relay.