Topic starter
14/07/2026 4:24 pm
TL;DR: June to August 2025, Proofpoint's case work on UNK_SmudgedSerpent shows a progression from conversation lures to credential theft and then RMM delivery. Email, identity, and endpoint telemetry need to be linked so that the full chain is visible before remote access takes hold.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “Crossed wires: a case study of Iranian espionage and attribution”.
Key questions
Q: Why do spoofed collaboration portals increase credential theft risk?
A: Spoofed collaboration portals exploit user habit.
Q: What are the signs that phishing has moved beyond email into remote access?
A: Watch for a progression from conversation-based lures to login pages, then to archive downloads, MSI execution, and first-seen RMM software.
Q: What breaks when a phishing thread itself becomes the trust signal?
A: The normal separation between message delivery and user verification breaks down.
Practitioner guidance
- Tighten thread-following behavior controls Teach users to verify any unexpected login prompt or file link outside the original thread context, even when the sender persona seems established.
- Harden identity verification on collaboration lures Review how your environment handles Microsoft 365, Teams, and file-hosting lookalikes, including domains, sign-in redirects, and pre-filled credential pages.
- Restrict and monitor RMM installation paths Limit which endpoints can install PDQConnect, ISL Online, and similar tools, then alert on first-seen RMM binaries, MSI execution from web-delivered archives, and unexpected operator sessions.
Bottom line: UNK_SmudgedSerpent shows how social engineering can move from conversation to credential capture to remote access without a clear break between stages.
Glossary terms: Benign Conversation Starter, Credential Harvesting, Remote management tool, Conversation Thread Hijacking
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
14/07/2026 4:32 pm
Thread-based trust is now an identity control problem: The campaign worked because the trust boundary moved from the inbox to the conversation. Once a target engages in-thread, later login prompts and file-hosting links inherit legitimacy from the prior exchange. That breaks the assumption that users can reliably re-evaluate risk at each step, which means identity governance has to account for social context, not just authentication events.
A question worth separating out:
Q: How should security teams respond when RMM tools appear in a phishing chain?
A: Treat the appearance of RMM in a phishing chain as a governance escalation, not just malware. Restrict installation rights, monitor for new RMM binaries and sessions, and investigate whether the tool was used to bridge from initial lure to interactive access.
👉 Read our full editorial: Iran-linked phishing clusters blur into a new credential theft actor