Threat Actors Exploit LogMeIn Resolve, ScreenConnect in Phishing Campaigns

Sophos documents an ongoing phishing campaign (STAC6405) that lures victims with invite‑themed messages to install preconfigured LogMeIn Resolve or ScreenConnect installers, granting attackers persistent remote access; in follow‑up activity attackers have delivered an info‑stealer (HeartCrypt-packed payloads), used living‑off‑the‑land tactics and legitimate RMM/remote‑access software to harvest credentials and access crypto wallets, affecting 80+ organizations primarily in the US.