Executive Summary
A long-running fraud operation, tracked as AnyDesk TAG, has been active since at least March 2026, targeting customers of major financial institutions across the UK and Australia. The campaign utilizes highly convincing cloned bank support pages to facilitate social engineering over the phone. Victims are guided through a 'verification' process that leads to the installation of legitimate remote-access tools or custom-wrapped malicious payloads.
Technical analysis reveals a sophisticated multi-stage delivery chain. Attackers use Extended Validation (EV) Authenticode signatures—specifically identifying 'Botania Games'—to bypass security warnings and deploy ScreenConnect for unattended access. In some instances, the actors utilize DLL side-loading (T1574.002) by bundling a genuine Microsoft Defender component with a malicious 'mpclient.dll' to execute their payload while evading detection.
This campaign is highly active and evolving, with over 380 linked domains identified as of October 2026. The transition from interactive AnyDesk sessions to persistent ScreenConnect access allows the threat actors to maintain long-term control over victim environments, posing a significant risk for financial theft and unauthorized data access within the banking sector.