A wolf in admin clothing.

Proofpoint uncovered TrustConnect, a malware-as-a-service operation that poses as a legitimate remote monitoring and management (RMM) product while functioning as a remote access trojan (RAT) offered to criminals for roughly $300/month. The campaign used a fake business website, legitimate-looking certificates, and branded installers (e.g., fake Microsoft Teams/Zoom) to distribute implants that provide full remote control, file transfer, and surveillance; despite partial disruption of infrastructure, operators quickly produced new variants, showing resilience and integration with the broader cybercriminal ecosystem.