Phishing kits and remote tools turn intrusions into a supply chain

A convincing phishing message can be the visible end of a larger operation. Microsoft’s 14 October investigation describes a Chinese-language ecosystem connecting kit developers, infrastructure dealers and the actors buying from them. Researchers followed a phishing kit into a marketplace and shared cloud-related infrastructure used to target organisations across several countries.

The account distinguishes the developer, an infrastructure supplier and downstream users of the tools. That division matters for interpreting a cluster of similar messages: shared templates or hosting can reflect a common supplier, even when different operators send the campaigns. Microsoft also describes a disruption involving its Digital Crimes Unit and external partners. The investigation supplies the linkage and attribution, rather than the mere appearance of one phishing page.

A separate 29 September report follows phishing observed in July that distributed disguised MSP360 remote-management installers. Microsoft said those installations were used to add a second remote-access channel through ScreenConnect. It explicitly distinguished this abuse from exploitation of ScreenConnect itself. The software could be genuine while the installation request and intended controller were deceptive.

The editorial implication is to investigate the services and identities created after the initial message as well as the message itself. Removing the lure does not answer who controls installed management software or which credentials were accessed. The two investigations concern different activity, but both show why a phishing incident can span suppliers, installers and continuing access. Evidence should connect those stages before assigning them to one operator or declaring the incident contained.