BlueDash Phish Uses Fake Teams Update to Install Dual RMM Tools
BlueDash is a Nigeria-linked phishing operation that lures victims with a counterfeit Microsoft Teams update page to trigger a PowerShell-based loader, which downloads and installs multiple remote monitoring and management tools (including Level RMM and ConnectWise ScreenConnect) and registers the host with an attacker-controlled enrollment secret for persistent access; the campaign uses cross-brand lures (like Zoom) and shared infrastructure on Berrydev.xyz and GitHub Pages, and includes reconnaissance steps to map system state, firewall posture, and privileged local accounts to guide its next moves.