Multi-RMM attack: Splashtop Streamer and Atera payloads delivered via Discord CDN link · Blog · Sublime Security

This Attack Spotlight describes an email-based campaign where a compromised Microsoft 365 account and OneDrive impersonation were used to trick recipients into downloading a file whose extension was manipulated (.docx → .msi). The installer deployed two RMM tools (Atera and Splashtop), downloaded from legitimate sources and Discord CDN, giving attackers persistent remote access; Sublime's detection engine intercepted the attack before further payload or ransom activity was observed.