Hackers Abuse NinjaOne RMM Agent to Gain Remote Access to Brazilian Organizations

An active phishing campaign targeting Brazilian organizations uses Portuguese-language business-document lures to trick victims into downloading a legitimately signed NinjaOne RMM installer configured to register with attacker-controlled management endpoints, providing persistent remote access and full RMM capabilities. The report describes delivery portals, anti-analysis techniques (geofencing, browser fingerprinting, honeypots), observed domains as IoCs, ties to previously seen Venon RAT infrastructure (tentative), and recommends endpoint allowlisting and following CISA/NSA/MS-ISAC guidance.