Sophisticated Voicemail-Themed Social Engineering Campaign Deploys Remote Access Tools A newly uncovered social engineering campaign is leveraging fake voicemail notifications to trick victims into installing remote access tools, granting attackers persistent control over compromised systems. First detected on January 12, 2026, the attack has already compromised 86 web properties, primarily targeting German-speaking users with deceptive voicemail lures. ### How the Attack Unfolds Victims receive communications directing them to compromised websites designed to mimic legitimate voicemail notification pages. These sites use bank-related subdomains (e.g., bannerbank[.]cadillac[.]ps, allsouthfcu[.]cadillac[.]ps) and a minimalist, professional design to appear trustworthy. The interface prompts users to "listen" to a voicemail, a routine action that reduces suspicion. Upon interaction, victims unknowingly download a Windows BAT file disguised as an audio-related update. The script displays benign update messages, conditioning users to approve security prompts. While an English-language voicemail plays in a minimized browser window as a decoy, the real payload executes in the background. ### Exploitation of Legitimate Tools The BAT file installs Remotely RMM, a legitimate remote monitoring and management tool, but enrolls the victim’s system into an attacker-controlled command-and-control (C2) server. This grants threat actors full remote access, enabling lateral movement, data exfiltration, credential theft, or ransomware deployment. ### Why the Attack Succeeds The campaign’s effectiveness stems from psychological manipulation rather than technical exploits. By mimicking familiar voicemail notifications and using a legitimate RMM tool, attackers bypass both human vigilance and security software. The multi-stage approach including audio playback as a distraction further reinforces the illusion of legitimacy. ### Indicators of Compromise (IOCs) The campaign leverages multiple bank-themed subdomains under cadillac[.]ps, including: - bannerbank[.]cadillac[.]ps - allsouthfcu[.]cadillac[.]ps - coastalccu[.]cadillac[.]ps - royalcu[.]cadillac[.]ps The attack highlights how threat actors combine social engineering with legitimate tools to evade detection, posing a significant risk to organizations and individuals alike.