New
Phishing Abuses Rmm Tools For Persistent Access
In July 2026, Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries that distributed a masqueraded MSP360 Remote Monitoring and Management (RMM) installer through meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content. Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected devices and enabled threat actors to gain an initial foothold using trusted administrative software.
Microsoft observed the MSP360 deployment being used to download and install a ConnectWise ScreenConnect client, creating a secondary remote-access channel that provided redundant access to compromised systems. Microsoft did not observe exploitation of ScreenConnect software itself; rather, threat actors abused legitimately obtained remote administration software to establish and maintain access. After access was established, threat actors used these remote administration channels to deploy additional tools and conduct post-compromise activity, including information collection and credential-access operations.
Popular Products
-
Enamel Heart Pendant Necklace$49.56$24.78 -
Digital Electronic Smart Door Lock wi...$211.78$105.89 -
Automotive CRP123X OBD2 Scanner Tool$649.56$324.78 -
Portable USB Rechargeable Hand Warmer...$61.56$30.78 -
Portable Car Jump Starter Booster - 2...$425.56$212.78