Fake SSA Emails Drive Venomous#Helper Phishing Campaign

A long-running phishing campaign called Venomous#Helper has compromised over 80 organizations (primarily in the US) by delivering signed RMM binaries (SimpleHelp and ScreenConnect) via SSA-themed lures and compromised websites; the attackers achieve silent, persistent dual-channel access, use evasion techniques (e.g., renamed WMIC binary, SafeBoot persistence, watchdogs), and likely operate as financially motivated initial access brokers or ransomware precursors.