Threat Actors Abuse LogMeIn Resolve and ScreenConnect in Multi-Stage Phishing Attacks

A US-focused phishing campaign (tracked as STAC6405) distributed preconfigured legitimate LogMeIn Resolve installers via themed landing pages and compromised/impersonated senders to register victim machines to attacker-controlled accounts, impacting over 80 organizations; in some incidents ScreenConnect was abused to deploy a ValleyRAT-like infostealer and concealment utilities, enabling credential, session token, and cryptocurrency wallet theft. Recommendations include restricting software installations to an approved list, removing or blocking unauthorized RMM tools, enforcing strong credential hygiene, and promptly blocking related URLs and IoCs across network entry points.