Hackers Hide RMM Installs as Fake Chrome Updates and Teams Invites

This report describes phishing campaigns documented by Red Canary and Zscaler that use highly convincing lures (fake browser and meeting updates, e-cards, and forged government forms) to deliver legitimate RMM installers (ITarian, Atera, PDQ, SimpleHelp). Attackers abuse those RMM tools to obtain admin-level access and deploy additional malware or ransomware; the report highlights delivery techniques (signed installers, cloud hosting, masquerading filenames) and recommends layered defenses such as user education, EDR/network monitoring, and strict RMM policies.