A Single Canadian Tax Lure Spread into a 46-Country, US-First RMM Campaign

As ANY.RUN analysis shows, a campaign that initially appears to target Canadians with fake Canada Revenue Agency (CRA) T4 tax documents is actually part of a much broader remote-access campaign spanning 46 countries, with 45% of observed activity associated with the United States.

The attackers impersonate trusted organizations and document types to trick victims into installing legitimate remote management software, giving them remote access to compromised systems.

Part I. Campaign Scope, Impact, and Defense

Threat Overview

This phishing operation’s final goal is the remote control of the victim’s machine. A reusable fake-document kit delivers interchangeable, legitimate RMM software installer, which the attacker then abuses for hands-on access.

Because the payload is signed commercial software, ordinary signature-based antivirus cannot flag it. Its activity resembles ordinary remote administration.

View this malware analysis in TI Reports

The campaign uses multiple lures, including the US Social Security Administration, Adobe PDF documents, invoices, VAT notices, and shipping communications, allowing the same attack model to target victims across different regions and business contexts.

Campaign Profile

Statistics and Victimology

Two scopes are important here: the CRA/T4 Word arm, with 137 observed cases, and the broader fake-document family, covering 425 kit URLs across 240 hosts and 601 cases with geographic and industry context.

Activity grew from a single observed case in January 2026 to a steady 17–33 cases per month. Because the final payload is legitimate signed RMM software, cases are tracked through shared kit assets rather than malware-family verdicts, which would significantly undercount the campaign.

Geographically, the broader family is US-first, while the CRA/T4 arm is Canada-first. North America accounts for 61% of family cases, but activity spans 46 countries, with 35 contributing 1% or less. Canada represents 16% of the broader family but 33.3% of the CRA/T4 arm, consistent with deliberate targeting around the Canadian tax lure.

Across industries, education, technology, and government appear prominently in both datasets. Technology figures may be influenced by higher security-team submission rates, while the exposure seen in education and government is more consistent with genuine targeting.

Banking, manufacturing, and finance also feature prominently, aligning more closely with the campaign’s invoice and VAT-themed lures.

These figures represent where campaign samples were observed rather than confirmed compromises, so they should be treated as indicators of targeting focus and a proxy for the potential victim population.

What to Take Back to Your SOC Team

For security leaders, the key takeaway is that defenses need to be product-agnostic. This campaign abuses legitimate, signed RMM software and can switch between vendors, so controls built around a specific tool or AV verdict will leave gaps. Ensure your SOC focuses on the delivery chain and unauthorized remote-access activity instead.

• Treat the RMM install itself as a signal, whatever the product. GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, and ITarian have all been abused in this campaign. Detection should focus on how the software reaches the environment, particularly installations originating from new free-hosting domains or compromised WordPress pages, rather than on the RMMproduct itself.

• Build detection around persistent campaign patterns. Disposable Vercel infrastructure rotates rapidly: 94% of 240 observed hosts appeared for only a single day. Instead of relying primarily on domains, prioritize stable kit indicators, including the fmtt / font1.woff2, icons8-microsoft-word-94.png asset, and the secure.html → project/*.zip chain.

• Account for password-protected archive delivery. The campaign pairs fake document pages with password-protected ZIP files and provides the password to the victim, helping payloads evade automated inspection. Mail-layer controls and user awareness should account for this delivery pattern.

• Baseline authorized remote-access tooling. Maintain an inventory of approved RMM products and ensure the SOC can quickly identify unexpected installations or activity.

• Give analysts behavioral and threat context in one investigation workflow. In this analysis, ANY.RUN’s Interactive Sandbox exposed the delivery chain, browser activity, scripts, and network requests, while Threat Intelligence Lookup expanded persistent indicators into the wider campaign.

Part II. Technical Malware Analysis

Introduction

New *.vercel[.]app deployments appear more or less constantly, each only days old.

One of them, fillingconfirmation[.]vercel[.]app, had been registered just one day before it was observed. Vercel suits the operator well: every deployment comes with valid TLS, a trusted domain, and one-command redeployment. All this gives the lures the reputation needed to clear mail filters while remaining cheap enough to abandon at will.

The activity has continued since January 2026 at a steady monthly pace, with 18 to 57 new kit hosts appearing each month. Cloudflare, Kaseya/INKY, and CyberArmor have also reported on this activity, with findings consistent with what follows here.

The delivery chain

The attack begins with a phishing email linking to a disposable *.vercel[.]app page disguised as a legitimate document. The CRA/T4 lure is one example, alongside SSA, VAT, invoice, shipping, and other document-themed variants.

The page redirects to secure.html, which provides an access code and downloads a password-protected ZIP – the payload. Once the victim extracts and runs the VBS script inside, PowerShell downloads and installs a legitimate RMM agent, giving the operator hands-on-keyboard remote access.

The Kit’s Handwriting Revealed via Advanced URL Analysis

Using ANY.RUN’s in-browser data inspection, we reconstructed the full browser-side chain, including DOM changes, redirects, page content, and screenshots of what the victim sees at each stage.

Every deployment ships essentially the same page, byte for byte. Several recurring DOM elements reveal the kit’s distinctive handwriting:

• An empty title.

• A @font-face declaration for font-family:’fmtt’ sourcing url(img/font1.woff2) — the shared font that links the broader family.

• img src=’img/icons8-microsoft-word-94.png’ id=’fd’ alt=’PDF Icon’ — a Word icon persistently mislabeled as “PDF Icon.”

• A #rl red spinner element.

• A three-hop meta-refresh chain: root page → secure.html → project/<lure>.zip.

• The recurring “Downloading 2025 T4 Form…” and access-code text.

For additional cover, the kit opens a harmless decoy PDF through legitimate OneDrive infrastructure (1drv[.]ms, onedrive[.]live[.]com, and canadaeast1-mediap[.]svc[.]ms). Its purpose is simply to make the download appear routine to the victim.

Execution behavior

Using Static discovering in ANY.RUN’s Interactive Sandbox, we inspected the VBS script responsible for launching the next stage of the attack.

The chain progresses only after the victim enters the on-page access code. This unlocks a single VBS script that uses FileSystemObject to launch POWERSHELL.EXE and download the next stage.

PowerShell does the rest: it skips the user profile, introduces a sleep delay to evade timing-based analysis, writes binary data to a stream, and downloads and installs the RMM MSI. Once installed, the RMM agent gives the operator live, hands-on-keyboard access to the system.

Evasion

Evasion operates across multiple stages of the delivery chain. The first layer is the archive: project/<lure>.zip returns HTTP 200 but remains password-encrypted, leaving automated pipelines with an inert ZIP they cannot open. The VBS inside is extracted and executed only after the victim enters the on-page access code.

The second layer sits in front of payload delivery. The page fingerprints the browser, IP address, and geolocation using FingerprintJS, an hCaptcha challenge, and a “Green Spinner” gate. On some pages, the results are relayed to api.telegram[.]org, allowing the payload to be served only to visitors that pass the checks while filtering out suspected analysis environments.

The PowerShell stage adds timing-based evasion by calling sleep before reaching out for the MSI installer.

HTTP request analysis in ANY.RUN’s Interactive Sandbox made these delivery and evasion flows visible.

Following the network trail revealed a broader, highly distributed infrastructure.

Network Infrastructure

• Delivery infrastructure: The family includes 82 code-identical Vercel apps, each observed for only a single day, alongside GitHub Pages, Netlify, compromised legitimate websites, and throwaway domains. Vercel is particularly useful to the operator because each new deployment inherits valid TLS and domain reputation.

• Payload staging: RMM installers are staged across rotating infrastructure, including Amazon S3, Cloudflare R2, GitHub, DigitalOcean Spaces, gofile[.]io, Dropbox, compromised sites, and raw-IP hosts.

• RMM infrastructure: The remote-access product is interchangeable. At least five legitimate RMM products have appeared across the family, while the delivery chain remains largely unchanged.

The evidence behind each product is uneven, which bounds what any per-product signature can cover:

Those measured artifacts cover the GoTo and LogMeIn slot only.

The RMM stage is the thinnest layer of evidence in the chain: 20 of the 137 arm cases are observed fetching the MSI, while the rest stop at the password-protected archive, and the same MSI appears in 150 cases index-wide, so it is staged across delivery arms beyond this kit.

Neither the staging host nor the RMM backend identifies the operator. The MSI sits on shared, abused cloud storage, and the backend is each vendor’s own infrastructure, so neither layer establishes that one operator is behind all of it. The delivery kit’s handwriting is what ties the activity together.

The fact that the product in the RMM slot changes between arms is another reason why this slot is the weakest layer for building a durable signature.

Cluster Expansion

The CRA/T4 arm is one part of a broader delivery framework whose document themes, domains, and RMM payloads change while the underlying kit remains stable. The shared fmtt web font (img/font1.woff2) provides a particularly strong pivot into that wider activity.

To determine whether this is a shared phishing-as-a-service kit with several affiliates, we can use Threat Intelligence Lookup for cluster expansion:

url:”*img/font1.woff2″ OR url:”*/icons8-microsoft-word-94.png” OR SHA256:”51f0cc172ced2e90acbc01c2872c697644380e597076350a6b286c96ab7ccb42″

The query returns 601 analysis cases across the three indicators (at the time of writing). The font alone links 425 distinct kit URLs across 240 hosts and 155 IPs between February 5 and July 29, 2026, exposing activity well beyond the CRA/T4 arm.

The same fingerprint produced no matches across roughly 46,000 cases from ten unrelated malware families, supporting its use as an operation-specific marker rather than a generic web artifact.

Infrastructure Footprint

The font1.woff2 query provides a direct measure of the family’s delivery infrastructure. Across 174 days, it identified 425 distinct kit URLs on 240 hosts resolving to 155 IPs.

The hosting breakdown shows how this infrastructure is distributed across different host types:

Push-button deployment platforms account for 83 of the 240 hosts, with Vercel supplying 82 of them. Every Vercel app was observed on exactly one day with exactly one kit URL and was never reused, indicating a one-app-per-lure deployment model that makes domain-level blocking quickly obsolete.

New hosts appear at a steady clip, while Vercel deployments arrive in bursts — 23 new apps in March, at the height of Canadian T4 season, and 20 more in July:

The infrastructure also splits into two distinct URL patterns. All 83 Vercel and Netlify apps serve the kit directly from /img/font1.woff2, while 110 other hosts use per-recipient paths in the form /ftx/<slug>-<epoch>-<hex>/.

The embedded Unix timestamps reveal the campaign’s operational tempo: the median link was first observed just 32 minutes after generation, and 77% within 24 hours. This strongly suggests that links are generated per recipient and used almost immediately.

Reputation follows the same divide. Of 425 URLs, 23 were already rated malicious when observed, all hosted on cheap-TLD throwaway domains. None were Vercel apps, suggesting that the platform provides the clean domain reputation the operator’s own disposable domains lack.

Conclusion

This analysis uncovered a 46-country, US-first campaign that abuses legitimate RMM software while rapidly rotating domains, lures, and remote-access products. The more durable detection opportunity lies in the delivery framework: recurring kit patterns and unsolicited RMM installation rather than individual IOCs or product names.

Using ANY.RUN’s Interactive Sandbox, we exposed the full attack chain, from browser activity and redirects to scripts, processes, and network traffic. Threat Intelligence Lookup then turned persistent indicators into pivots for uncovering related infrastructure and expanding the investigation across the wider campaign.

About ANY.RUN

ANY.RUN provides interactive malware analysis and threat intelligence solutions to more than 16,000 organizations and 700,000 security professionals worldwide.

Its Interactive Sandbox helps SOC teams, MSSPs, and threat researchers investigate malware, suspicious files, and URLs in controlled virtual environments. Analysts can observe execution chains, inspect network activity, and uncover malicious behavior in real time to make faster, more confident decisions.

ANY.RUN Threat Intelligence turns data from real-world investigations into actionable threat intelligence, helping security teams enrich alerts, uncover related infrastructure, investigate campaigns, and track evolving threats.

TTPs

IOCs

All indicators are defanged.

Kit handwriting (detection patterns):

– */secure.html on host *.vercel[.]app

– */project/*.zip on host *.vercel[.]app

– *img/font1.woff2 — the family-wide font pivot (425 URLs / 240 hosts)

– Per-recipient path pattern /ftx/<6-char slug>-<10-digit epoch>-<12-hex>/ on non-platform hosts (289 URLs / 110 hosts); the epoch field dates the link’s generation

– DOM: font-family:’fmtt’ + img/font1.woff2 + alt=’PDF Icon’ + “Access code is” text

Lure deployments (representative; 82 Vercel apps observed in total):

– fillingconfirmation[.]vercel[.]app

– sharedconfirmationslip[.]vercel[.]app

– officialsummarybycra[.]vercel[.]app

– 2026t4form17718[.]vercel[.]app

– crataxsummary1007341[.]vercel[.]app

– statemendetailsfilessenderderf[.]netlify[.]app

Throwaway domains carrying a malicious verdict at observation:

– quavix[.]vu

– cevora[.]vu

– xorlira[.]vu

– voretix[.]icu

– wurel[.]sbs

– mornixa[.]cfd

– getdl[.]jorix[.]cyou

– pdfmarchlitestatementsscannedforyou[.]gixar[.]sbs

– reportstastementformarchreviewyourssaast[.]harnivo[.]cfd

Dynamic-DNS kit hosts (attacker-controlled subdomains of legitimate DDNS providers — block the host, not the provider):

– 54511[.]ddnsking[.]com

– dxy43[.]ddnsking[.]com

– dyb32[.]ddnsking[.]com

– 67pon[.]swoop2[.]me

– dcsi23[.]swoop2[.]me

– ssi11[.]letsgo2[.]me

– ddn3[.]net2me[.]me

Captured RMM MSI: – hxxps://commonerdays[.]vercel[.]app/LogMeInResolve_Unattended.msi

Payload staging (attacker-controlled buckets):

– mayteslaadvisorhq[.]s3[.]us-east-2[.]amazonaws[.]com

– openfodervbs4view[.]ams3[.]cdn[.]digitaloceanspaces[.]com

Durable origin IP:

– 46.62.197[.]232:7000

Compromised legitimate sites (kit path only):

– hiltonheadislanddeals[.]com

– gonzalezjaramilloabogados[.]com

– mybcdc[.]ca

– taurusburgerco[.]com[.]au

– ypatellawoffice[.]ca

– electrical-sei[.]com

– herculescalgarymovers[.]ca

– quantechitsolutions[.]com

Kit page content hashes (SHA256):

– 41b731279b1778a9f578e4ed2589f46c4bef32793b292862cf96279a3ead1c41 (lure index page)

– 132d864bb199105d639edb115249302243eafdb0fc21efb86cc6b6c0d49866f0 (secure.html gate page)

– 51f0cc172ced2e90acbc01c2872c697644380e597076350a6b286c96ab7ccb42 (icons8-microsoft-word-94.png asset)

Sources

• Cloudflare Cloudforce One — Vercel-hosted RMM abuse campaign evolves with Telegram C2 for victim filtering — https://www.cloudflare.com/cloudforce-one/research/report/vercel-hosted-rmm-abuse-campaign-evolves-with-telegram-c2-for-victim-filtering/

• Kaseya / INKY — The Vercel incident and the phishing campaigns already hiding in plain sight — https://www.kaseya.com/blog/phishing-campaigns-abusing-vercels-free-hosting-platform/

• CyberArmor — Cybercriminals Abusing Vercel to Deliver Remote Access Malware — https://www.cyberarmor.tech/blog/threat-insight-cybercriminals-abusing-vercel-to-deliver-remote-access-malware

• Red Canary — The dual-use dilemma: Rethinking detection for remote access tool abuse — https://redcanary.com/blog/security-operations/rmm-detection/

• Broadcom / Symantec — RMM Abuse Continues: Malicious LogMeIn Resolve Activity on the Rise — https://www.broadcom.com/support/security-center/protection-bulletin/rmm-abuse-continues-malicious-logmein-resolve-activity-on-the-rise

• Canada Revenue Agency — Recognize a scam — https://www.canada.ca/en/revenue-agency/corporate/scams-fraud/recognize-scam.html