# Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update

> **Newsylist Open Intelligence Dossier** · First detected: 2026-07-28 16:29 UTC · Category: Technology · Sources: 4 · Current Velocity: 2.5

## Executive Summary
A coordinated campaign dubbed Operation BlueDash is using fraudulent Microsoft Teams updates to install remote access tools on corporate systems.

## Intelligence Brief
Operation BlueDash uses fake software updates to deploy Level RMM, Tactical RMM, and ScreenConnect, granting unauthorized parties control over victim PCs. The campaign involves attackers impersonating IT support staff to facilitate vishing attacks within Microsoft Teams. This activity occurs alongside a reported 10-fold increase in Teams-based vishing and a total of 7.6 billion detected email phishing threats, according to CyberSecurityNews, The Hacker News, and gbhackers.com.


Corporate environments remain the primary target as attackers manipulate users into accepting these malicious updates to steal access credentials. Coverage from cybersecurity outlets indicates that these multiple remote management tools provide redundant control channels. Future updates will track whether organizations adjust authentication protocols or software update delivery processes to mitigate these impersonation tactics.

## Verified Facts & Key Claims
### What is Operation BlueDash?
It is a phishing campaign that exploits Microsoft Teams to deploy remote monitoring and management tools like Level RMM and ScreenConnect.

### How do the attackers gain access?
Attackers impersonate IT support via Teams vishing and trick users into installing fake updates that enable remote PC control.

### What tools are being deployed?
Coverage identifies Level RMM, Tactical RMM, and ScreenConnect as the specific tools installed during the attacks.

## Key People, Organizations & Locations
Operation BlueDash Deploys Level RMM and ScreenConnect, Fake Teams Update, Microsoft Detects, Billion Email Phishing Threats, Teams Vishing Attacks Increases, Operation BlueDash Phishing Campaign Deploys Level RMM ScreenConnect and Tactical RMM, Attackers Abuse Microsoft Teams, Impersonate IT Support and Steal Corporate Access

## Multi-Source Evidence Table
| Source Outlet | Headline | Published (UTC) | Verification URL |
|---|---|---|---|
| CyberSecurityNews | Microsoft Detects 7.6 Billion Email Phishing Threats as Teams Vishing Attacks Increases 10-Fold | 2026-07-27 12:37 | [Source Link](https://news.google.com/rss/articles/CBMihAFBVV95cUxQSDNfNV80ZWxYcUcwZFJYT2ZDQVF4TnZJQVlBVjRLQmJRUFYwN2NDWjJxWHVhSF9VbG1qQlAwXzhOMFgxcUpFR21FUzc1TUVKY00yNEQxOWRHdVJQQnJ3WEVTY1NfZl94VDk1VzhrelVCOHlhSkxTVmpLYXVjdkhoNTk4VlHSAYoBQVVfeXFMT1VzRzBEcS14LU1CWWE4Q1pSdFBaMi1iN25BN183Qlc4cnNOaGI0UF9ENzk5Z1ByUkxiQkpiWkFZRHdLYjJnMzRpaC01cElyMzJtZV9SaDF5QjBVSndiallianJGT0RZZUktMzJTZWhZeVZsZGctd1daS2o4SEo0UTdKUGl4TEt3alZB?oc=5) |
| cyberpress.org | Operation BlueDash Phishing Campaign Deploys Level RMM, ScreenConnect and Tactical RMM | 2026-07-27 12:37 | [Source Link](https://news.google.com/rss/articles/CBMibEFVX3lxTE1nMU45UnkyUUpZSVc3TlVvbzZ0Ti1aU1d1NlhvQk1MWmM4UGJsOXdub25nVXQxbXFKdThleDZKbklGUGtueG9pS2s5TXhxRW1QbW5IWmMyOFgwT3VwemxDTUdJSjQxbVhPRXVaZNIBbEFVX3lxTE1nMU45UnkyUUpZSVc3TlVvbzZ0Ti1aU1d1NlhvQk1MWmM4UGJsOXdub25nVXQxbXFKdThleDZKbklGUGtueG9pS2s5TXhxRW1QbW5IWmMyOFgwT3VwemxDTUdJSjQxbVhPRXVaZA?oc=5) |
| gbhackers.com | Attackers Abuse Microsoft Teams to Impersonate IT Support and Steal Corporate Access | 2026-07-27 12:37 | [Source Link](https://news.google.com/rss/articles/CBMiW0FVX3lxTE1ZT3gxRFQ3bE8yODBrVVpucmo1X0h4RnYzaFZ0bmxpWVhTX3FQQzEtOHhHYWl2dktTUEMwYVlJc1JQTC1hMGp3RHVqWFB2emZBcTlIRWxvWlBBT0XSAWBBVV95cUxPQXJLeEUweGhpYTk3UzN5NE80enRKNThwcWRockNReTlDNHh6QzlDLW1URHdjUENOTG1qY2lMU1F4RVpRN3phS0RJZEE3YktVdjdQTmp0S3c2ano5MlplRlc?oc=5) |
| CyberSecurityNews | A Fake Teams Update Can Give Hackers Two Separate Ways to Control Your PC | 2026-07-27 12:37 | [Source Link](https://news.google.com/rss/articles/CBMickFVX3lxTE4xTkNDTmdaNklOdVhaeFJUNW5CWjZWTXdYdW1yRVdLZE1xYzh5Skg2dWllMnZwVjlrb0NDa2FsM2NDWWkzbDM5MTI1SkJDWlhjSTl1eW5vSzBocWttZ0tadGhJMjUyYTM0ZVRIWDhOTUhTd9IBd0FVX3lxTE5jcjJzOXdxNVdiYV9VbkdXRnAwYTVvd0ZnMWNuc0hRazdINF9xRllvUC1XTVdhUzM3WFdsQXZ6RXdWUUdzRHo3UEc4MG9uT2cxYUZET0FFMDdOSS1VamdYRFJrcHdLSEZBYUpmaTBUQldpNzdDN3pR?oc=5) |
| The Hacker News | Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update | 2026-07-27 12:37 | [Source Link](https://news.google.com/rss/articles/CBMigAFBVV95cUxNcGU1VXVyT3RoSXhvemxpdjJJMTBEVHRfTDhycDNNeGQ3MHBxdW12NmV2cHE4cXRTRlNRTEdjdWY2bnNlVXNodmRxdkhhREhrRURfdFNVb1JvQ3B0SGtMZDJYa1JheEZuUG5hRUVoSC1zekphRlZMTlcyOXZtOVdqTA?oc=5) |

---
*Canonical Source: https://www.newsylist.com/trend/2026-07-28/operation-bluedash-deploys-level-rmm-and-screenconnect-via-fake-teams-update*
*Synthesized by Newsylist Open Intelligence Engine under E-E-A-T journalistic standards.*