[et_pb_section fb_built=”1″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content” custom_padding=”9px|||||”][et_pb_row column_structure=”1_2,1_2″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”1_2″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n
We\u2019ve noticed a spike in phishing attempts disguised as \u201cpre-Christmas party invites\u201d.\u00a0 While the festive spirit is infectious, so too is the threat. These aren\u2019t just generic holiday greetings \u2014 they\u2019re carefully crafted lures designed to hook users into downloading malware, often via links to malicious installers or fake login prompts.<\/p>\n
[\/et_pb_text][\/et_pb_column][et_pb_column type="1_2" _builder_version="4.27.4" _module_preset="default" global_colors_info="{}" theme_builder_area="post_content"][et_pb_image src="https:\/\/new.kinetics.co.nz\/wp-content\/uploads\/2025\/11\/Bad-Santa2.png" title_text="Bad Santa2" _builder_version="4.27.4" _module_preset="default" border_radii="on|20px|20px|20px|20px" box_shadow_style="preset1" global_colors_info="{}" theme_builder_area="post_content"][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version="4.27.4" _module_preset="default" global_colors_info="{}" theme_builder_area="post_content"][et_pb_column type="4_4" _builder_version="4.27.4" _module_preset="default" global_colors_info="{}" theme_builder_area="post_content"][et_pb_text _builder_version="4.27.4" _module_preset="default" global_colors_info="{}" theme_builder_area="post_content"]<\/p>\n
This isn\u2019t new. Cybercriminals are well aware of the seasonal rush \u2014 Black Friday, Cyber Monday, and the holiday rush all create the perfect storm for phishing. Expect to see emails promising \u201cexclusive deals,\u201d \u201cfailed transactions,\u201d \u201crefunds pending,\u201d or \u201curgent login required.\u201d These are classic tactics used to trigger urgency and bypass caution.<\/p>\n
But here\u2019s the twist \u2014 and the reason we\u2019re raising the alarm: the tools they\u2019re using are the same ones your MSP and IT teams rely on daily.<\/strong><\/p>\n Attackers are now deploying ScreenConnect, LogMeIn Resolve, Naverisk, SimpleHelp, PDQ, and even Atera \u2014 the very same remote management tools many IT companies use to support your clients, manage systems, and maintain uptime.<\/span><\/p>\n This isn\u2019t a coincidence. It\u2019s a calculated move.<\/p>\n A persistent, highly active threat actor, first observed in April 2025, has evolved its tactics. Initially, they leveraged ScreenConnect as their primary foothold. By June 2025, they began incorporating SimpleHelp and by October 2025, LogMeIn Resolve and Naverisk were added to the mix \u2014 and now, multiple common IT support tools are often installed sequentially, sometimes weeks after initial access.<\/p>\n Why? The theory is simple: Redundancy. Resilience. Obfuscation.<\/strong><\/p>\n By installing multiple tools, attackers create a layered, persistent access point. They can rotate tools to avoid detection, mask their presence behind legitimate admin software, and even disable security controls like Windows Defender using tools like Defender Control. Credential harvesting tools like WebBrowserPassView are also frequently deployed, all to extract data, maintain access, and maximise their return.<\/p>\n This is not just a shift in tactics.\u00a0 It is a strategic evolution. The attackers are no longer relying on a single, easily detectable tool.\u00a0 Instead, they\u2019re building a resilient, multi-tool infrastructure that mimics legitimate IT operations \u2014 making detection and attribution far more difficult.<\/p>\n The fact that they\u2019re using tools your own suport team uses makes this even more concerning. It\u2019s not just about access.\u00a0 It is about blending in, staying long-term, and exploiting the very systems you\u2019re trying to protect.<\/p>\n This isn\u2019t a \u201cmaybe\u201d or \u201cpossibly\u201d.\u00a0 This is happening now.<\/p>\n Stay alert. Stay secure. And don\u2019t let the holidays fool you.\u00a0 The real threat is lurking behind every festive email.<\/p>\nWhat\u2019s happening?<\/strong><\/h2>\n
Analyst\u2019s take:<\/strong><\/h2>\n
What should you do?<\/strong><\/h2>\n
\n