Security NewsHighIncidentphishing
Phishing Campaign Hits 80+ Orgs Using SimpleHelp and ScreenConnect RMM Tools
UnknownMay 4, 2026(about 2 hours ago)
A phishing campaign, VENOMOUS#HELPER, has impacted over 80 organizations using SimpleHelp and ScreenConnect RMM tools to gain remote access.
An active phishing campaign has been observed targeting multiple vectors since at least April 2025, with legitimate Remote Monitoring and Management (RMM) software as a way to establish persistent remote access to compromised hosts. The activity, codenamed VENOMOUS#HELPER, has impacted over 80 organizations, most of which are in the U.S., according to Securonix. It shares overlaps with clusters