Threat Brief — 2026-07-27 — RMM abuse and sandbox escapes dominate

Executive summary. Two distinct campaigns are abusing legitimate remote-management tooling as the final payload: Operation BlueDash delivers Level RMM and ScreenConnect via Teams-themed phishing, while the Cruciferra crypter service combines BYOVD and Process Ghosting to hide Windows malware. Separately, a patched n8n sandbox escape could let workflow editors run OS commands on the host. A new eSIM-based SIM-swap scheme removes the need for SMS or password interception.

Top items

• n8n expression-sandbox escape (patched). A high-severity flaw in n8n's expression sandbox lets any authenticated workflow editor break out and execute operating-system commands as the n8n process. Security Joes discovered the issue in n8n's February-era code; a patch is now available. If you run self-hosted n8n with multiple workflow editors, prioritise patching — this is a straightforward path from low-privilege authenticated access to host RCE. (src: The Hacker News)

• Operation BlueDash deploys Level RMM and ScreenConnect via fake Teams updates. A Microsoft Teams-themed phishing campaign uses "secure document" lures to deliver legitimate RMM tools (Level RMM, ScreenConnect) through compromised web infrastructure. The abuse of genuine RMM software gives attackers persistent access while blending into normal administrative traffic. This aligns with the broader trend of RMM-as-foothold we've seen across multiple campaigns this month. (src: The Hacker News)

• Cruciferra crypter combines BYOVD and Process Ghosting for malware concealment. A China-linked cybercrime group targeting Indian taxpayers and finance professionals is using the Cruciferra crypter service, which employs Bring-Your-Own-Vulnerable-Driver (BYOVD) and Process Ghosting techniques to evade detection on Windows. The service is actively deployed in income-tax-themed phishing operations. Organisations running Windows endpoints without kernel-level driver blocklists should review their BYOVD posture. (src: The Hacker News)

• eSIM-based SIM-swap removes need for SMS or password. A new SIM-swap scheme targeting customers of a major carrier exploits eSIM provisioning to steal phone numbers without intercepting SMS 2FA or knowing account passwords. This bypasses the traditional safeguards organisations rely on for MFA via SMS. Any account-recovery or authentication flow that depends on SMS OTP should be reviewed for eSIM-portability risk. (src: SecurityLab)

• Steam Workshop used to distribute malware via hijacked game Discord. Attackers compromised the official Discord server for Meccha Chameleon (nearly 100,000 members) and pushed malicious Steam Workshop map downloads bundled with malware. Game-adjacent communities continue to be a productive vector — this follows the Steam forum ClickFix attacks reported on 2026-07-25 by BleepingComputer but is a distinct attack chain targeting Workshop content rather than forum posts. (src: SecurityLab)

Themes

Legitimate-tool subversion. Operation BlueDash (RMM tools) and Cruciferra (BYOVD with signed drivers) both illustrate attackers leaning on trusted software and kernel drivers to maintain presence and evade EDR. The pattern is consistent — endpoint controls that don't scrutinise RMM binary execution or driver loading will miss these.

Gaming-platform abuse. Steam remains a recurring attack surface: forum-based ClickFix (first reported 2026-07-25) and now Workshop-distributed malware via hijacked community channels show the platform's collaborative features are being systematically exploited.