The “Special Invitation” Trap: STAC6405 Abuses Legitimate RMM Tools to Hijack Your PC

Sophos MDR reports on STAC6405, an active phishing campaign since April 2025 that leverages compromised trusted accounts and polished brand-mimicking lures to trick victims into installing legitimate RMM tools (LogMeIn Resolve / ScreenConnect), providing attackers with unattended remote access used for credential and wallet theft, system reconnaissance, living-off-the-land persistence, and secondary malware deployment.