Initial Access Brokers Target Brazil Execs via NF-e Spam and Legit RMM Trials

A new campaign targeting Portuguese-speaking users in Brazil uses trial versions of commercial remote monitoring and management (RMM) software. The spam messages, disguised as financial institution or cell phone carrier notifications, trick users into clicking on Dropbox links leading to RMM tool installers. The campaign primarily targets C-level executives and financial/human resources accounts across various industries.