Loading story…
Microsoft reported unattributed phishing campaigns that targeted multiple industries in July 2026 with a legitimate, signed MSP360 RMM v2.5.0.67 installer disguised as meeting invitations, documents, software updates, and other business content. Users who executed the installer and approved UAC elevation enabled persistent MSP360 services, registry autoruns, and a firewall rule, granting the operators trusted remote-management access.
The MSP360 agent launched PowerShell to retrieve and silently install a ConnectWise ScreenConnect client from actor-controlled infrastructure, establishing a second remote-access path. Operators then used ScreenConnect to transfer and execute masqueraded tools for credential access, local data collection, payload execution, and reduced defender visibility; Microsoft found no ScreenConnect vulnerability exploitation and did not attribute the activity to a named actor. Defenders should review and restrict unauthorized RMM tooling through application-control policies, Defender indicators and certificate-based controls, attack-surface-reduction rules, and cloud-delivered Defender Antivirus protection.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft observed unattributed phishing campaigns targeting multiple industries that used a legitimate signed MSP360 RMM v2.5.0.67 installer disguised as business-themed files. Following UAC-approved installation, the campaigns established MSP360 persistence and downloaded and silently installed ConnectWise ScreenConnect for redundant remote access.
Microsoft disclosed technical details of the phishing activity, including use of ScreenConnect to deploy credential-access, data-collection, and defense-evasion tools. Microsoft reported no ScreenConnect vulnerability exploitation and did not attribute the campaigns to a named threat actor.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 32 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
microsoft.com
Open sourcelearn.microsoft.com
Open sourcetechcommunity.microsoft.com
Open sourcelearn.microsoft.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Huntress investigated three phishing-led intrusions in which attackers abused legitimate remote monitoring and management (RMM) tools to gain persistent access. One campaign used a TransferXL-hosted ZIP archive and malicious PDF lure to prompt installation of **ITarian**, then deployed **ScreenConnect**; two others used fraudulent document-sharing emails branded as ScreenConnect to install multiple ScreenConnect clients. The attackers configured rogue RMM agents for `SYSTEM`-level persistence, created redundant remote-access channels, and used defense-evasion tooling including `HideUL_x64.exe`. Huntress reported RMM abuse rose **277%** during 2025 and appeared in nearly 40% of incidents investigated by its Tactical Response team, underscoring the need to restrict, inventory, and monitor authorized remote-management software.
Sep 23, 2026
Threat actors abused the legitimate **Faronics Deploy** cloud endpoint-management platform to enroll victim devices into attacker-controlled deployments, execute remote PowerShell scripts, and install **ConnectWise ScreenConnect** for persistent interactive remote access. From July 21 to August 20, the campaign exposed more than 457 endpoints through invoice, tax-document, and business-file phishing lures. Victims were directed to cloaked, fingerprinting-enabled phishing pages and persuaded to run signed Faronics installers masquerading as Adobe software, documents, or updates. The attackers used Faronics Deploy to retrieve follow-on tooling and establish a ScreenConnect channel independent of the abused management platform. Faronics was notified on August 5, implemented anti-abuse controls, and contacted potentially affected organizations; observed activity dropped substantially after August 21. Organizations should investigate unexpected ScreenConnect installations, review `Faronics ScriptRunner.log` for remotely supplied script URLs, and use Faronics configuration-request `ck` deployment identifiers to identify systems enrolled in malicious deployments.
Sep 5, 2026
Threat researchers reported multiple phishing-driven intrusions in which attackers impersonate trusted brands and agencies to trick victims into installing legitimate remote monitoring and management (RMM) software for persistent access. In **Operation DoppelBrand**, financially motivated actor **GS7** spoofed Fortune 500 financial and technology brands (including **Wells Fargo** and **USAA**) using more than **150** lookalike domains to harvest credentials and exfiltrate data via attacker-controlled **Telegram bots**; researchers also identified nearly **200** additional domains with short registration terms, automated SSL, wildcard DNS, and brand-specific subdomains supporting the campaign. Separately, Forcepoint X-Labs described a wave of emails impersonating the **U.S. Social Security Administration** that delivers an attached `.cmd` script to weaken Windows defenses and enable silent installation of **ConnectWise ScreenConnect**. The script checks/elevates privileges, disables **Windows SmartScreen** via registry changes, removes **Mark-of-the-Web**, and uses **Alternate Data Streams (ADS)** for stealth before installing an MSI and configuring ScreenConnect (via `System.config`) to beacon to an attacker-controlled server (reported as `dof-connecttop` on port `8041`). Both activity sets highlight a recurring tradecraft pattern: **brand impersonation + scripted defense evasion + abuse of legitimate RMM tooling** (e.g., *LogMeIn Resolve*, *ScreenConnect*) to gain remote control and facilitate follow-on theft or persistence.
Jun 29, 2026