Quick Summary
A phishing attack has been identified that uses stolen credentials to install LogMeIn’s Remote Monitoring and Management (RMM) software for persistent access. The attack involves fake emails disguised as invitations from Greenvelope to harvest login information from platforms like Microsoft Outlook and Yahoo!. Once credentials are obtained, attackers register with LogMeIn to create access tokens, allowing them to deploy RMM tools and maintain control over compromised systems.
The Securityish Brief
Cybersecurity researchers reported a dual-vector phishing campaign that targets users through fake invitation emails from a legitimate platform called Greenvelope. The attackers aim to steal credentials for services like Microsoft Outlook, Yahoo!, and AOL.com by tricking recipients into clicking on phishing links. Once they gain access to these credentials, the attackers register with LogMeIn using the compromised email to generate RMM access tokens.
Following the credential theft, the attackers deploy an executable named ‘GreenVelopeCard.exe,’ which is signed with a valid certificate. This executable installs LogMeIn Resolve (formerly GoTo Resolve) on the victim’s system, allowing the attackers to establish persistent remote access without the victim’s knowledge. The software is configured to connect to an attacker-controlled URL, facilitating ongoing control.
Once the RMM tool is installed, the attackers modify its service settings to ensure it runs with unrestricted access on Windows. They also create hidden scheduled tasks that automatically launch the RMM program, even if the user attempts to terminate it. This method of using legitimate software as a backdoor poses significant risks to organizations and individual users alike.
Why This Matters for Your Security
This attack highlights the evolving tactics of cybercriminals who leverage trusted IT tools to bypass security measures. Organizations must be vigilant in monitoring for unauthorized installations of RMM software and unusual usage patterns. The use of legitimate software for malicious purposes underscores the importance of maintaining robust security protocols and user education to recognize phishing attempts.
Users should be aware of the signs of phishing attempts, such as unexpected emails requesting login information or containing suspicious links. Organizations should implement multi-factor authentication (MFA) to add an additional layer of security against credential theft.
- Greenvelope: A platform used by attackers to send fake invitation emails aimed at harvesting user credentials.
- LogMeIn Resolve: The RMM software that attackers deploy to maintain persistent access to compromised systems.
- GreenVelopeCard.exe: The executable file used to install LogMeIn Resolve on victim systems.
Key Takeaways
- Monitor for unauthorized installations of RMM software within your organization.
- Educate users on recognizing phishing emails and suspicious links.
- Implement multi-factor authentication (MFA) for all accounts to enhance security.
- Regularly review access logs for unusual activity related to RMM tools.
- Update security protocols to include checks for legitimate software misuse.
Key Terms & Concepts
- Remote Monitoring and Management (RMM): In this article, RMM refers to software that allows IT administrators to remotely manage and monitor systems.
- Phishing: Phishing is a cyber attack that attempts to trick individuals into providing sensitive information, such as login credentials.
- Greenvelope: Greenvelope is a legitimate platform that attackers impersonate to send fake invitation emails in this phishing campaign.
- LogMeIn Resolve: LogMeIn Resolve is the RMM software exploited by attackers to gain persistent access to compromised systems.
Read the original article here: https://thehackernews.com/2026/01/phishing-attack-uses-stolen-credentials.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
