# Phishing Campaigns Abuse RMM Tools (MSP360, ScreenConnect) for Persistent Access

> Microsoft Defender Experts observed phishing campaigns in July 2026 that deliver a masqueraded MSP360 RMM v2.5.0.67 installer, which is then used to silently deploy ConnectWise ScreenConnect for redundant remote access, credential theft and data collection. The activity is unattributed and targets organizations across multiple industries.

- **Published:** 2026-09-29T00:00:00Z
- **Last reviewed:** 2026-10-01T23:17:28.544Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2788
- **ID:** TL-2026-2788
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Microsoft Defender Experts identified phishing campaigns, active from July 2026, that distribute legitimate MSP360 remote monitoring and management (RMM) software masqueraded as something else. Lures include workplace meeting requests, Zoom and Google Meet installation prompts, Adobe Acrobat / PDF reader updates, RSVP invitations and e-cards, job offer documents, document review/signature requests and DHL package delivery content. Phishing emails point to actor-controlled landing pages that impersonate document portals, invitation workflows, Adobe Reader pages, Zoom installers and collaboration platforms. Victims are then redirected to download locations on attacker infrastructure and on legitimate cloud services (Amazon S3, Cloudflare R2, Dropbox, GitLab and Supabase). Observed installer file names follow a pattern of a themed lure name plus '_rmm_v2.5.0.67_oid<id>.exe', for example VIP_ECARD_INVITATION_rmm_v2.5.0.67, ZoomSetup_Installation_v2.5.0.67, 'PDF Reader & Editor the Adobe Acrobatte_rmm_v2.5.0.67', RSVP_INVITATION_E_CARD_rmm_v2.5.0.67 and SSA.GOV_STATEMENT_rmm_v2.5.0.67.

The installer is an NSIS-style package that drops System.dll, nsExec.dll, UAC.dll, RMM.Agent.exe and RMM.Agent.Launcher.exe under C:\Program Files\RMM Agent\. RMM.Agent.exe and RMM.Agent.Launcher.exe are registered as Windows services, registry autorun entries are created for the MSP360 UI components, and an inbound firewall allow rule is created for RMM.Agent.exe on UDP port 48678. Microsoft's report names seven actor-associated domains used with the RMM agent (adswre.cfd, trews.cfd, adsaw.cfd, swedcorry.stefneyv.com, ojsuyw.niyari.org, bunstar.harej.si and sdfghj.rd-team.ru).

Once the MSP360 agent is running, the actor uses it to execute PowerShell that downloads ClientSetup.msi from actor infrastructure and installs ConnectWise ScreenConnect silently with msiexec.exe /qn, giving a second, redundant remote access channel (ScreenConnect.ClientService.exe and ScreenConnect.WindowsClient.exe). Through ScreenConnect the actor stages further tooling in ...\Documents\ScreenConnect\Temp\ (including under the OneDrive-redirected Documents folder). The transferred tools include fake Windows security/PIN/password prompt executables (WindowsSecurity_PIN.exe, WindowsSecurity_Password.exe, WindowsPassKey.exe, PIN.exe, Passwords.EXE), Phone Link themed executables, Defender control utilities (DefenderControl.exe, DefenderDT.exe), UI-hiding utilities (SCHider.exe, HideFromControlPanel.exe, BannerHider.exe, HideCursor.exe, HideMouse.exe, MouseHiderGUI.exe, HideUL.exe, HideMouseApp.dll) and NirSoft-style browser credential viewers (WebBrowserPassView.exe, WebBrowserBookmarksView.exe). The tooling is consistent with credential theft, browser data collection and concealment of the remote session from the user.

Because both MSP360 and ScreenConnect are legitimate, signed administration products, the activity blends with normal IT operations and may bypass controls that only look for malware. Microsoft has not attributed the activity to a named threat actor. Defenders should inventory approved RMM tools, enforce MFA on them, use application control (WDAC/AppLocker) to block unapproved RMM software, hunt for the listed hashes/paths/services, and reset credentials on any host with an unapproved RMM install.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.006 Web Services
- T1566.002 Spearphishing Link
- T1204 User Execution
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1218.007 Msiexec
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1036.005 Match Legitimate Resource Name or Location
- T1112 Modify Registry
- T1555.003 Credentials from Web Browsers
- T1082 System Information Discovery
- T1005 Data from Local System
- T1219 Remote Access Tools
- T1071.001 Web Protocols
- T1573 Encrypted Channel
- T1562.004 Impair Defenses: Disable or Modify System Firewall
- T1105 Ingress Tool Transfer

## Sources

- [Phishing Abuses RMM Tools for Persistent Access](https://www.microsoft.com/en-us/security/blog/2026/09/29/phishing-abuses-rmm-tools-persistent-access/)
- [Fake Bank of America "Action Needed" Phishing Email Deposits ScreenConnect Instead](https://www.huntress.com/blog/bank-spam-rmm)
- [Trojanized ScreenConnect Installers Evolve, Dropping Multiple RATs on a Single Machine](https://www.acronis.com/en-us/tru/posts/trojanized-screenconnect-installers-evolve-dropping-multiple-rats-on-a-single-machine/)
- [PDF-Borne Living-Off-the-Land Attacks with RMM Abuse](https://www.sonicwall.com/blog/pdf-borne-living-off-the-land-attacks-with-rmm-abuse)
- [New Phishing Campaign Abuses ConnectWise ScreenConnect to Take Over Devices](https://www.infosecurity-magazine.com/news/phishing-abuses-connectwise-take/)
- [Rogue ScreenConnect: Common Social Engineering Tactics We Saw in 2025](https://socprime.com/?p=43414)
- [MITRE ATT&CK T1219 Remote Access Software](https://attack.mitre.org/techniques/T1219/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2788