Threat reportPhishingTL-2026-3526
Business-Themed Phishing Lures Deliver Abused RMM Tools (MSP360, ScreenConnect)
Business-Themed Phishing Lures Deliver Abused RMM Tools (TL-2026-3526) is a high-severity phishing campaign, first published 2026-10-14. It has no confirmed attribution, affects Microsoft Windows (endpoints targeted by abused RMM installers), maps to 15 MITRE ATT&CK techniques (T1036.005, T1059.001, T1071.001), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-3526
- Threat ID
- TL-2026-3526
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- multiple industries
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Business-Themed Phishing Lures Deliver Abused RMM Tools
Malware and tooling: SupportScam:Win32/RogueMSP.MU!MTB, ConnectWise ScreenConnect, MSP360, MSP360 RMM v2.5.0.67, ScreenConnect
How Business-Themed Phishing Lures Deliver Abused RMM Tools works
Phishing campaign observed by Microsoft Defender Experts in July 2026 uses business-themed lures (meeting invites, Zoom/Adobe Reader installers, document-sharing portals) to deliver the legitimate MSP360 RMM agent, which then pulls down ConnectWise ScreenConnect for redundant persistent access. Payloads are hosted on attacker infrastructure and on Amazon S3, Cloudflare R2, Dropbox, GitLab and Supabase; no named actor has been attributed.
Microsoft Defender Experts observed a phishing campaign in July 2026, reported by Microsoft on 2026-09-29 and echoed by KnowBe4 on 2026-10-14, in which threat actors abuse legitimate remote monitoring and management (RMM) software instead of custom malware. Lures include workplace meeting requests and RSVP invitations, Zoom and Google Meet setup prompts, Adobe Acrobat/PDF reader updates, e-cards, job offer documents, document review and signature requests, and DHL package delivery themes. Landing pages impersonate document-sharing portals, invitation workflows, Adobe Reader pages and Zoom installation sites. Installers are served from actor-controlled domains, compromised legitimate websites and cloud storage/hosting services (Amazon S3, Cloudflare R2, Dropbox, GitLab, Supabase).
The primary foothold is a digitally signed, legitimate MSP360 RMM v2.5.0.67 installer (SHA256 108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc) distributed under deceptive filenames such as ZoomSetup_Installation_v2.5.0.67_oid[...].exe and 'PDF Reader & Editor the Adobe Acrobatte_rmm_v2.5.0.67_oid[...].exe'. Microsoft Defender Antivirus detects the initial delivery as SupportScam:Win32/RogueMSP.MU!MTB. Once run, the installer registers RMM.Agent.exe and RMM.Agent.Launcher.exe as Windows services, adds registry autorun persistence, and creates a Windows Firewall rule permitting inbound UDP traffic to RMM.Agent.exe on port 48678. FaronicsDeployAgent.exe was observed in parallel activity as an alternative initial vector.
Using remote command execution through the MSP360 agent, the actors launch PowerShell to download ClientSetup.msi (ConnectWise ScreenConnect) and install it silently with msiexec.exe /qn, producing ScreenConnect.ClientService.exe and ScreenConnect.WindowsClient.exe connected to actor-controlled relay domains. This gives a second, redundant access channel that reduces dependence on any single tool. ScreenConnect file transfer and RunFile functionality are then used to stage and execute utilities from ScreenConnect\Temp folders under the user's Documents and OneDrive\Documents directories: credential-access tools (WindVerify.exe, WindowsUpdate.exe, WindowsSecurity_PIN.exe, WindowsPassKey.exe, Passwords.EXE, WebBrowserPassView.exe), defense-evasion tools (SCHider.exe, DefenderControl.exe, HideMouse.exe, HideFromControlPanel.exe) and information-gathering utilities.
Defenders should treat any unapproved RMM install as suspicious: enforce an allow-list of approved RMM tools with application control (AppLocker publisher rules, certificate blocking), require MFA on sanctioned RMM platforms, reset credentials of accounts that installed the detected services, and hunt for post-compromise credential theft. Microsoft published four KQL hunting queries covering MSP360 hash presence, MSP360-launched PowerShell/msiexec activity, ScreenConnect connections to malicious URLs, and RunFile payload drops.
MITRE ATT&CK techniques used in TL-2026-3526
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1218.007 Msiexec
Execution
T1059.001 PowerShell; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1219 Remote Access Tools
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools; T1686 Disable or Modify System Firewall
Persistence
T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder
Credential Access
T1555.003 Credentials from Web Browsers
Initial Access
Resource Development
Affected products and versions in Business-Themed Phishing Lures Deliver Abused RMM Tools
- Microsoft — Windows (endpoints targeted by abused RMM installers)
Vulnerable versions: Not version-specific; abuse of legitimate software, no vulnerability - MSP360 — MSP360 RMM Agent (legitimate software abused)
Vulnerable versions: 2.5.0.67 observed - ConnectWise — ScreenConnect (legitimate software abused)
Vulnerable versions: Not version-specific
Remediation for Business-Themed Phishing Lures Deliver Abused RMM Tools
Immediate actions
- Hunt for unapproved RMM software (MSP360 RMM.Agent.exe, ScreenConnect client services) and isolate affected hosts
- Block the listed domains (adswre.cfd, trews.cfd, adsaw.cfd, swedcorry.stefneyv.com, ojsuyw.niyari.org, bunstar.harej.si, sdfghj.rd-team.ru) and the listed SHA256 hashes
- Reset passwords for accounts used to install the detected RMM services and any credentials stored in browsers on affected hosts
- Remove the inbound Windows Firewall rule for RMM.Agent.exe on UDP 48678 and inspect ScreenConnect\Temp folders for staged utilities
Workarounds
- Configure AppLocker publisher rules to block non-approved RMM instances
- Use Microsoft Defender certificate blocking to block specific signed RMM applications
- Enable cloud-delivered protection in Microsoft Defender Antivirus
Longer-term hardening
- Enforce application control policies to block unapproved IT management tools
- Enforce multi-factor authentication on approved RMM systems
- Implement zero-trust remote access policies and monitor for post-compromise credential-access activity
- Enable Microsoft Defender attack surface reduction rules, including advanced ransomware protection and blocking process creations from PsExec and WMI commands
Timeline of Business-Themed Phishing Lures Deliver Abused RMM Tools
- July 2026 (source gives month only; day is a month-level placeholder): ScreenConnect RunFile and file transfer used to stage credential-access and defense-evasion utilities in ScreenConnect\Temp folders
- July 2026 (source gives month only; day is a month-level placeholder): the MSP360 agent runs PowerShell to download ClientSetup.msi and installs ConnectWise ScreenConnect silently via msiexec /qn
- Microsoft Defender Experts observe phishing campaign delivering MSP360 RMM v2.5.0.67 installers under deceptive filenames (exact dates within July 2026 not stated)
- Microsoft Security Blog publishes 'Phishing abuses RMM tools for persistent access' with IOCs, detections and four KQL hunting queries
- Campaign added to Threadlinqs platform as TL-2026-3526; no named actor attributed
- KnowBe4 blog publishes 'Business-Themed Phishing Lures Deliver RMM Tools' summarizing Microsoft's findings
Sources cited for Business-Themed Phishing Lures Deliver Abused RMM Tools
- Phishing Abuses RMM Tools for Persistent Access (Microsoft Security Blog)
- Business-Themed Phishing Lures Deliver RMM Tools (KnowBe4)
- MITRE ATT&CK T1219 Remote Access Software
- MITRE ATT&CK T1566.002 Phishing: Spearphishing Link
- MITRE ATT&CK T1218.007 System Binary Proxy Execution: Msiexec
- MITRE ATT&CK T1583.006 Acquire Infrastructure: Web Services
Detection coverage for TL-2026-3526
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3526 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3526
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.