Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update

ZeroBEC has documented "Operation BlueDash," a Microsoft Teams- and Zoom-themed phishing campaign that coerces victims into downloading a loader (supportdev.exe) which runs hidden PowerShell to fetch legitimate RMM tools (Level RMM, ConnectWise ScreenConnect, Tactical RMM) and register the host using attacker-controlled enrollment tokens; the campaign uses GitHub Pages and custom domains for phishing infrastructure and has been attributed with moderate-to-high confidence to operators in Nigeria. The report also highlights credential-harvesting activity (JIVS PhishKit) and references the broader abuse of RMMs and recent takedowns of phishing kits like Kratos.