Threat Actors Using Fake Notepad++ and 7-zip Websites to Deploy Remote Monitoring Tools

Researchers observed a growing campaign where cybercriminals use fake download sites mimicking popular utilities (e.g., Notepad++, 7-Zip) to deliver legitimate RMM tools (LogMeIn Resolve, PDQ Connect). Once installed, the RMM clients register with their cloud management infrastructure and attackers execute PowerShell commands through the RMM to install the PatoRAT backdoor, providing persistent remote access and enabling follow-on actions such as credential theft or ransomware; the report emphasizes detection challenges since the tools appear legitimate and recommends downloading from official sources and monitoring RMM activity.