The threat actor claims to be selling Unauthorized RDWeb access to a US Consumer Services company with a domain user account and Microsoft Defender enabled.