Research from ANY.RUN, published August 25, started with something narrow: a wave of fake Canada Revenue Agency T4 tax slips landing in Canadian inboxes. By the time the researchers finished tracing the infrastructure behind those emails, the picture had changed completely. The same operation was running in 46 countries, using a rotating cast of tax, shipping, and invoice lures, and the United States, not Canada, had become its single biggest target, accounting for roughly 45 percent of observed activity. Coverage from The Hacker News on September 3 brought the fuller scope to a wider audience. What makes the campaign worth a closer look is not the lure. It is what happens after the click, where the payload is not malware at all but a fully legitimate, digitally signed remote access tool.
A Lure That Outgrew Its Own Country
ANY.RUN traced the campaign’s activity back to January 2026 and, working from that starting point, identified 425 phishing-kit URLs spread across 240 hosts between February 5 and July 29. Its sandbox connected 601 separate cases to the wider operation. The CRA T4 theme that first drew attention was just one variant in a rotating set: the same infrastructure has carried US Social Security Administration notices, Adobe PDF viewer prompts, invoices, VAT alerts, UPS and other shipping notifications, and generic shared-file lures. Education, technology, and government rank among the most targeted sectors, alongside a steady presence in banking, finance, and manufacturing.
Infrastructure Built to Disappear
The operators are not registering lookalike domains and waiting for them to get flagged. ANY.RUN identified 82 code-identical applications hosted on Vercel, each one live for a single day before being replaced, alongside pages on Netlify and GitHub Pages, compromised legitimate websites, and a rotating pool of throwaway domains. A landing page built this way looks, to most filtering, exactly like what it is: a page hosted on a trusted developer platform that millions of legitimate projects also use. By the time any single page gets flagged, it has already been swapped for a new one.
The Password-Protected Archive Is the Point
Clicking through the lure does not deliver a file directly. It delivers an access code, which unlocks a password-protected ZIP archive hosted on that disposable landing page. This step is not an inconvenience for the victim, it is the design. Automated email gateways and sandboxes that scan attachments cannot open a password-protected archive without the code, and the code only exists on the web page, not in the email itself. The scanning tools built to catch a malicious attachment before it reaches an inbox have nothing to inspect.
Inside the archive is a VBS script. Running it triggers PowerShell, which quietly downloads and installs the operation’s actual payload.
Legitimate Software as the Final Payload
That payload is not custom malware. Across the campaign, ANY.RUN observed the installation of real, digitally signed remote monitoring and management tools, including ScreenConnect, ConnectWise, Atera, PDQ Connect, GoTo Resolve, LogMeIn Rescue, ITarian, Syncro, JumpCloud, GetScreen, and SuperOps. In a number of cases, the operators chained more than one RMM tool onto the same victim machine, building in redundant, hands-on-keyboard remote access so that removing one tool does not end the intrusion. Because the installed software is genuine and properly signed, it does not trip the same alarms a custom trojan would. To an endpoint tool checking a signature, this looks like an IT department doing its job.
Why DMARC Never Sees Any of This
DMARC’s entire job is to answer one question: did the domain in a message’s From header actually authorize that message to be sent. When it does that job well, at policy p=reject, it stops an attacker from forging your domain in a phishing email. That is a real and valuable thing to control.
None of it reaches anywhere near this campaign’s actual mechanism. The link in the email points to a Vercel or Netlify subdomain, not a forged version of the recipient’s own domain or a brand they trust, so there is no impersonation for DMARC to catch in the first place. The password gate on the ZIP archive sits entirely outside any protocol that inspects a message’s headers. The VBS script and the PowerShell command it triggers execute after the email has already been read and trusted. And the tool that finally lands on the victim’s machine is not flagged software wearing a fake identity, it is real ScreenConnect or real Atera, with a real vendor signature, doing exactly what it was built to do for whoever controls it. DMARC authenticates a sender’s name. It has no mechanism for evaluating a disposable landing page, an encrypted archive, or a legitimate binary being pointed at the wrong operator.
What This Means for Your Program
Do not equate a trusted hosting platform with a trusted link. A URL on vercel.app, netlify.app, or github.io carries none of the reputation of the platform itself, and disposable subdomains that live for a single day are built specifically to outrun domain-reputation blocklists.
Treat password-protected archives in unsolicited email as a signal, not a formality. The password exists to defeat your scanning tools, not to protect the recipient, and a legitimate sender rarely has a reason to lock a document behind a code delivered on a separate web page.
Watch for RMM software your team did not deploy. A digitally signed installer for ScreenConnect, Atera, or any other remote access tool is not inherently safe just because it is signed. Inventory which RMM platforms your organization actually authorizes, and alert on any others.
Remember DMARC’s boundary stays fixed even as attacker infrastructure changes. A strict DMARC policy on your own sending domains is still worth enforcing, but it was never going to see a campaign that never needed to forge your domain to succeed.
The Takeaway
A single fake tax form, aimed at one country, turned out to be the visible edge of infrastructure running in 46 of them, refreshed daily, and ending not in malware but in ordinary IT software with real credentials behind it. That is the shape of a modern intrusion built to route around exactly the defenses most organizations already have in place. DMARC secures the identity on the envelope. It has nothing to say about a disposable web page, a password-locked archive, or a legitimate remote access tool doing an illegitimate job.
DMARC confirms whether a message claiming your domain actually had the authority to send it. It cannot tell you when a phishing email points to a disposable Vercel page, when a password-protected archive is hiding its contents from your scanners, or when a legitimate RMM tool has been installed by someone who was never supposed to have access. Excello Mail turns your DMARC aggregate reports into a clear, continuous record of every domain and service sending as you, so your own authentication stays airtight while your team watches for the threats that operate entirely outside what DMARC was built to see. Sign up for free to Excello Mail and get that foundation in place.