# The Fake Teams Update That Hands Attackers Your IT Toolbox
The alert doesn't look like an attack. It looks like a Tuesday.
A message arrives, a document needs reviewing, and Microsoft Teams needs a quick update before you can open it. The Microsoft Store page loads. The update installs. And somewhere, an attacker now has persistent remote access to your machine through software your IT department probably already whitelists.
That's the core of Operation BlueDash — a phishing campaign flagged by ZeroBEC researchers that weaponizes two legitimate remote monitoring and management platforms, Level RMM and ConnectWise ScreenConnect, by dropping them through a chain of compromised web infrastructure and a convincingly fake Microsoft Store page. No custom malware. No novel exploits. Just trusted software, installed the wrong way, by the wrong person.
## How BlueDash Actually Works
The campaign begins with a familiar lure: a "secure document" that supposedly can't be opened until Teams is updated. This is deliberately engineered to feel procedurally correct. Corporate users are trained to keep software current, and Teams updates frequently enough that the prompt doesn't immediately raise flags.
The victim follows the redirect chain through infrastructure that's been compromised specifically to serve this traffic — not purpose-built attacker servers, but legitimate sites that lend credibility to the chain. The destination is a counterfeit Microsoft Store page, polished enough to pass a quick glance.
What gets installed isn't a remote access trojan in the traditional sense. Level RMM and ScreenConnect are real commercial products, used daily by managed service providers and IT teams across thousands of organizations. They're signed. They're trusted by endpoint security tools. They create persistent, authenticated remote sessions — exactly what an attacker needs for the next stage of an intrusion, whether that's reconnaissance, lateral movement, or ransomware deployment.
## The Genius of Using Your Own IT Stack Against You
The RMM-as-attack-vector playbook isn't new, but it's maturing fast. CISA and the NSA issued a joint advisory in 2023 specifically warning that threat actors — including groups tied to business email compromise fraud — were using legitimate RMM software to maintain persistent access while evading detection. The advisory called out ScreenConnect and AnyDesk by name.
What BlueDash demonstrates is that the technique has evolved beyond opportunistic abuse. This isn't an attacker stumbling onto a machine with RMM already installed. This is a deliberate, multi-stage campaign that installs the RMM tool as the payload, using social engineering to make the victim believe they're doing something routine.
The implications for detection are severe. Most endpoint detection and response platforms are tuned to flag unusual binaries, obfuscated scripts, and known malware signatures. A signed ScreenConnect binary installing from what appears to be the Microsoft Store doesn't look like an attack — it looks like IT did something. Behavioral detection can catch it, but only if you're watching for unexpected RMM installations, new remote sessions from external IPs, or RMM tools running under user accounts rather than service accounts.
## Why Teams, Why Now
Microsoft Teams has become one of the most valuable phishing surfaces in the enterprise. It's installed on hundreds of millions of devices, updated constantly, and — critically — users encounter permission prompts and update notices through it regularly enough that the cognitive load of "Teams needs to update" is near zero.
Teams-themed attacks have spiked in the past two years. Midnight Blizzard (the Russian GRU-linked group behind SolarWinds) used Teams in a 2023 campaign to conduct credential phishing. Storm-1674 ran large-scale Teams vishing attacks using external access features that Microsoft has since restricted. BlueDash isn't riding on any of those campaigns — but it's fishing the same pond, because that's where the fish are.
The fake Microsoft Store page is a notable escalation. Earlier Teams-themed attacks often used more obviously sketchy domains or basic HTML clones. A fake Store page requires more investment in the lure and signals a campaign with real resources behind it, or at minimum, a threat actor willing to spend time getting the social engineering right.
## What Defenders Can Actually Do
The uncomfortable truth is that you cannot simply block ScreenConnect or Level RMM at the endpoint — too many organizations use them legitimately. But you can control the conditions under which they're allowed to run.
Application control policy should require RMM tools to be installed via IT-managed channels, not user downloads. If ScreenConnect appears on a machine but wasn't pushed from your RMM console, that's a detection event, not a compliance checkbox.
Network monitoring for RMM call-home traffic from unexpected hosts is underused. Both Level RMM and ScreenConnect have known relay infrastructure. A developer workstation suddenly beaconing to ScreenConnect relay nodes when no ticket is open is a signal worth investigating.
User training needs to address this specific scenario — not generic phishing, but the "legitimate-looking software update required to open a document" pattern. The lure works because it mimics real friction users encounter. Training should build skepticism toward that friction specifically.
Finally, Microsoft Store impersonation is worth flagging at the DNS/proxy layer. Domains that closely resemble microsoft.com or apps.microsoft.com but aren't Microsoft infrastructure should be caught before they render in a browser. Most modern secure web gateways can do this; the question is whether the rules are tuned.
---
## HackWire Analysis
Operation BlueDash isn't a technical breakthrough. It's a social engineering operation wearing a technical costume, and that framing matters for how defenders respond.
The campaign represents a convergence of three trends that have been building for years: RMM tool abuse as a standard post-access technique, fake software update lures as the delivery mechanism of choice, and Microsoft collaboration platforms as the highest-value phishing surface in the enterprise.
What other coverage is likely to miss: the choice of *two* RMM tools — Level RMM alongside the better-known ScreenConnect — suggests the operators are hedging against detection or takedown of either platform. Defenders who block or flag ScreenConnect may miss Level RMM entirely, since it has a smaller footprint in threat intel feeds. This dual-tool approach also hints at a more sophisticated operation than a one-off BEC crew would typically run.
The deeper pattern here is what I'd call "trust laundering." Attackers aren't just avoiding malware detection — they're specifically choosing tools that carry institutional legitimacy. IT uses these. Businesses pay for these. The fact that something is legitimate software has become, paradoxically, part of the attack surface. Security teams need to stop asking "is this binary malicious?" and start asking "should this binary be here, installed this way, by this user?"
The Microsoft Store impersonation vector also deserves more attention than it usually gets. The Store carries strong implicit trust — users associate it with verified, safe software. Faking it isn't just credential harvesting; it's trust harvesting, and it has a much longer shelf life than a fake login page.
For incident responders: if you find Level RMM or ScreenConnect installed without a corresponding IT change ticket, treat it as a presumed compromise and work backward from there.
— HackWire Editorial
---
## Related Coverage