Fortra researchers identified an active phishing campaign that delivers a Remote Access Trojan by abusing Datto’s legitimate RMM platform as its command-and-control channel, giving attackers persistent, full remote access while blending into normal enterprise traffic. The campaign relies on social engineering rather than exploits and is difficult to detect because malicious activity is tunneled through trusted Datto RMM infrastructure over HTTPS.

Discover February 2026 BEC attack trends, including cash‑out methods, wire transfer increases, crypto scams, and key insights from Fortra’s FIRE team.

Executive SummaryGitHub email notifications are being abused to deliver vishing content, according to findings from the Fortra Intelligence and Research Experts (FIRE) team. Vishing, or voice phishing, is a type of social engineering attack in which threat actors attempt to trick their victim into revealing personal information over a phone call or voice message, often beginning with an initial...

Executive SummaryThe findings in this report come from the results of active defense engagements with BEC threat actors. Every month, Fortra Intelligence & Research Experts (FIRE) conducts hundreds of these engagements to collect comprehensive intelligence about BEC tactics and trends to help better understand how the BEC threat landscape is evolving. The primary findings for January 2026...