US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access

ANY.RUN researchers identified a US-focused phishing campaign called CSuite, analyzed across 351 sandbox submissions with 51% originating from the United States. The campaign primarily targets technology, manufacturing, government, and consulting sectors. CSuite combines Microsoft 365 session token theft with deployment of remote monitoring and management (RMM) tools to maintain persistent remote access. This dual-stage approach allows attackers to escalate a phishing incident into full account compromise and potential fraud. The campaign focuses on C-suite executives, making it a high-value business email compromise threat. The use of RMM tools enables stealthy post-compromise persistence that may evade traditional security controls.