CSuite Targets US and EU Organizations with Device-Code Phishing and Remote Access

CSuite is a large-scale, multi-stage phishing and remote-access operation targeting US and EU organizations that uses counterfeit Adobe/DocuSign/SharePoint/Zoom lures, device-code OAuth phishing and session capture to steal Microsoft 365 access, then deploys legitimate remote-management agents (ScreenConnect, Action1, Atera, Syncro, PDQ) as RATs for persistent endpoint control; the report maps TTPs to MITRE ATT&CK, lists extensive IOCs (domains, IPs, hashes), and provides detection and mitigation recommendations for SOCs.