U.S. Leads Global Remote‑Management Phishing Surge Across Nearly Half of Affected Nations

A new analysis reveals that a remote‑management‑tool (RMM) phishing operation, initially thought to focus on Canadian victims, is in fact a worldwide campaign that has targeted users in 46 countries, with the United States accounting for roughly 45% of the observed activity.

The scheme employs counterfeit Canada Revenue Agency tax forms to lure recipients into clicking malicious links or downloading payloads. While the use of CRA branding suggested a primarily Canadian focus, deeper investigation by security researchers showed that the same tactics are being deployed against a far broader audience.

RMM software, which allows IT administrators to control endpoints remotely, has become an attractive vector for cybercriminals because compromising such tools can grant persistent, low‑profile access to corporate networks. In this campaign, attackers distribute phishing emails that appear to come from legitimate tax authorities, prompting recipients to open attached documents or follow links that install malicious RMM agents.

Data collected from multiple threat‑intel feeds indicates that nearly half of the campaign’s traffic originates from the United States, with the remaining activity spread across Europe, Asia, and other regions. The breadth of the operation underscores how attackers are capitalizing on the universal relevance of tax‑season communications, adapting the lure to different jurisdictions while retaining the core phishing mechanics.

Security experts warn that the convergence of tax‑related social engineering and RMM abuse poses a heightened risk for businesses of all sizes. Once an RMM client is compromised, threat actors can execute commands, exfiltrate data, or deploy additional malware without immediate detection. The campaign’s multi‑country reach also complicates response efforts, as victims may be subject to differing regulatory requirements and incident‑response capabilities.

Authorities and industry groups are urging organizations to reinforce email hygiene, verify the authenticity of tax documents through official channels, and ensure that RMM tools are patched, monitored, and limited to authorized personnel. Implementing multi‑factor authentication for remote‑access solutions and conducting regular audits of privileged accounts are also recommended mitigations.

The discovery highlights the evolving nature of phishing threats that blend legitimate-looking content with sophisticated intrusion tools. As tax season approaches in many jurisdictions, analysts expect attackers to intensify outreach, making vigilance and rapid detection essential to prevent further compromise.