Vercel-hosted RMM abuse campaign evolves with Telegram C2 for victim filtering

Table of contents

Overview

The lure: financial urgency and impersonation

Attack chain breakdown

Detection & mitigation

Indicators of Compromise (IOCs)

Overview

In this snapshot, we will outline a novel phishing campaign observed from November 2025 to January 2026 which leverages the Vercel hosting platform to deliver a remote access tool. The campaign was first documented by CyberArmor in June 2025, although our latest intelligence confirms that this threat has not only persisted but evolved in its technical execution.

The core tactic remains the same: exploiting the "inherited trust" of *.vercel.app domains to bypass email filters and deceive users with financially themed lures, such as overdue invoices and shipping documents. However, the campaign has moved beyond simple file-dropping. We have now observed a sophisticated Telegram-gated delivery mechanism designed to filter out security researchers and automated sandboxes.

By transitioning from basic public file links to this "conditional delivery" model, the threat actors have demonstrated a concerted effort to evade the detection signatures generated by earlier reporting. This snapshot outlines the updated attack chain, the shift to GoTo Resolve (formerly LogMeIn) as a "Living off the Land" (LotL) tool, and critical mitigation strategies for security teams.

The lure: financial urgency and impersonation

This campaign's effectiveness hinges on exploiting the "abuse of trust" in legitimate services. Attackers craft phishing emails with financial or business themes, such as "unpaid invoices," "payment statements," or "document reviews."

These emails are not the primary lure; the Vercel-hosted link is. The attacker relies on:

1. Trusted domain: The vercel.app domain is legitimate and reputable, bypassing many email filters and lulling users into a false sense of security.

2. Plausible themes: The Vercel pages themselves are cleverly disguised, often impersonating a "secure" Adobe PDF viewer, a financial document portal, or a software download page.

3. Social engineering: In some cases, attackers masquerade as technical support, using the link to guide a victim to install the "fix."

This blended approach, using a trusted domain to host a thematically appropriate lure, manipulates the target into believing the interaction is safe and taking the desired action.

Attack chain breakdown

Stage 1: Initial delivery

The target receives a phishing email containing a link. The email body is often minimal, using urgent language ("due payment," "invoice attached") to pressure the user into clicking the embedded vercel.app link.

n the example below, te large PDF icon is not a real attachment but a hyperlinked image. Clicking it redirects the user to the malicious Vercel URL.

“Invoice Details” phishing example.

The email below, for example, claims an invoice is "43 days past due," pressuring the victim to click the "Download as Pdf" link, which initiates the RMM infection chain:

An example of the financial urgency lure.

The below email targets Spanish-speaking users with a "security update" lure, threatening service suspension to force a click.

An example of multilingual targeting.

Some emails, like the one pictured below, use a "Potential Lawsuit Notice" theme to panic the user into downloading the malicious payload.

A phishing email impersonating a secure document signing portal.

The email page below, for example, mimics a Meta "Community Standards" warning, using the threat of page removal to trick social media managers into installing the backdoor.

A specialized lure targeting business account owners.

Stage 2: Evasion and redirection

Upon clicking the link, the target is not immediately served the payload. This is a key evasion step.

1. Fingerprinting: The malicious page first performs browser fingerprinting, collecting the victim's IP address, location, device type, and browser.

2. Data exfiltration: This data is exfiltrated to a threat-actor-controlled Telegram channel.

3. Conditional delivery: The server uses this data to decide whether to deliver the payload, filtering out security researchers, sandboxes, and non-target geolocations.

If the victim is deemed "valid," they are presented with the fake document viewer or invoice page and prompted to download the file.

Stage 3: Payload deployment and execution

This leads the user to download a file disguised as a document or statement (e.g., Statements05122025.exe, Invoice06092025.exe.bin).

• Payload: The executable is not custom malware but a "Potentially Unwanted Program" (PUP) — a legitimate, signed version of GoTo Resolve (formerly LogMeIn) remote access software.

• Execution: By abusing this "Living Off the Land" (LotL) tool, the attacker bypasses most signature-based antivirus detections.

Impact: Upon execution, the tool installs and establishes a connection to its remote servers, providing the attacker with a full backdoor and remote control over the victim's host.

Detection & mitigation

This campaign was identified through its use of Vercel as a file dropper and the specific detection fingerprints built to catch this behavior. To protect against similar attacks, organizations should:

• Enhance email security: Deploy security solutions that can analyze links at time-of-click and detect service abuse and brand impersonation.

• Monitor TLDs: Due to the high rate of abuse, organizations should consider enhanced monitoring of links from vercel.app and surge.sh subdomains, pending user verification.

• Application control: Enforce application whitelisting or strict policies governing the installation of new remote desktop and support tools.

• User training: Conduct phishing simulations that specifically educate users on the "abuse of trust" tactic, showing that a valid SSL certificate (padlock) and a known domain name do not always equal safety.

The following detections were written by Cloudflare Email Security to protect against phishing campaigns leveraging the techniques in this attack:

• SentimentCM.Banking.Invoice.Service_Abuse.Vercel.Link - 50K hits in last 30 days

• Brand_Impersonation.Facebook.Service_Abuse.Vercel.Link - 600 hits last 30 days

• Sentiment_CM.Shared_Document.Service_Abuse.Vercel.Link -

• Brand_Impersonation.Financial_Institutions.Service_Abuse.Vercel.Link

Service_Abuse.Vercel.URL_Shortener.Link - 500 hits last 30 days

IOCs

List all known technical indicators associated with the campaign in a structured format.

Domains / IPs

Email Detection Fingerprint (EDF)

File Hashes