Topic starter
14/07/2026 4:24 pm
TL;DR: Credential harvesting pages, spoofed OnlyOffice and Teams lures, benign conversation starters, and RMM payloads were used against academics and policy experts from June to August 2025 as Proofpoint tracked UNK_SmudgedSerpent, with TTP overlap across TA453, TA455, and TA450. The pattern shows how phishing, identity deception, and remote tooling can converge into a flexible access path that security teams must treat as a governance problem, not just an email problem.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “Crossed wires: a case study of Iranian espionage and attribution”.
Key questions
Q: What breaks when a phishing thread itself becomes the trust signal?
A: The normal separation between message delivery and user verification breaks down.
Q: Why do spoofed collaboration portals increase credential theft risk?
A: Spoofed collaboration portals exploit user habit.
Q: What are the signs that phishing has moved beyond email into remote access?
A: Watch for a progression from conversation-based lures to login pages, then to archive downloads, MSI execution, and first-seen RMM software.
Practitioner guidance
- Tighten thread-following behavior controls Teach users to verify any unexpected login prompt or file link outside the original thread context, even when the sender persona seems established.
- Harden identity verification on collaboration lures Review how your environment handles Microsoft 365, Teams, and file-hosting lookalikes, including domains, sign-in redirects, and pre-filled credential pages.
- Restrict and monitor RMM installation paths Limit which endpoints can install PDQConnect, ISL Online, and similar tools, then alert on first-seen RMM binaries, MSI execution from web-delivered archives, and unexpected operator sessions.
Bottom line: UNK_SmudgedSerpent shows how social engineering can move from conversation to credential capture to remote access without a clear break between stages.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:32 pm
Thread-based trust is now an identity control problem: The campaign worked because the trust boundary moved from the inbox to the conversation. Once a target engages in-thread, later login prompts and file-hosting links inherit legitimacy from the prior exchange. That breaks the assumption that users can reliably re-evaluate risk at each step, which means identity governance has to account for social context, not just authentication events.
A question worth separating out:
Q: How should security teams respond when RMM tools appear in a phishing chain?
A: Treat the appearance of RMM in a phishing chain as a governance escalation, not just malware. Restrict installation rights, monitor for new RMM binaries and sessions, and investigate whether the tool was used to bridge from initial lure to interactive access.
👉 Read our full editorial: Iran-linked phishing clusters blur into a new credential theft actor