# Business-Themed Phishing Lures Deliver Abused RMM Tools (MSP360, ScreenConnect)

> Phishing campaign observed by Microsoft Defender Experts in July 2026 uses business-themed lures (meeting invites, Zoom/Adobe Reader installers, document-sharing portals) to deliver the legitimate MSP360 RMM agent, which then pulls down ConnectWise ScreenConnect for redundant persistent access. Payloads are hosted on attacker infrastructure and on Amazon S3, Cloudflare R2, Dropbox, GitLab and Supabase; no named actor has been attributed.

- **Published:** 2026-10-14T16:56:22Z
- **Last reviewed:** 2026-10-14T16:56:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3526
- **ID:** TL-2026-3526
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Microsoft Defender Experts observed a phishing campaign in July 2026, reported by Microsoft on 2026-09-29 and echoed by KnowBe4 on 2026-10-14, in which threat actors abuse legitimate remote monitoring and management (RMM) software instead of custom malware. Lures include workplace meeting requests and RSVP invitations, Zoom and Google Meet setup prompts, Adobe Acrobat/PDF reader updates, e-cards, job offer documents, document review and signature requests, and DHL package delivery themes. Landing pages impersonate document-sharing portals, invitation workflows, Adobe Reader pages and Zoom installation sites. Installers are served from actor-controlled domains, compromised legitimate websites and cloud storage/hosting services (Amazon S3, Cloudflare R2, Dropbox, GitLab, Supabase).

The primary foothold is a digitally signed, legitimate MSP360 RMM v2.5.0.67 installer (SHA256 108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc) distributed under deceptive filenames such as ZoomSetup_Installation_v2.5.0.67_oid[...].exe and 'PDF Reader & Editor the Adobe Acrobatte_rmm_v2.5.0.67_oid[...].exe'. Microsoft Defender Antivirus detects the initial delivery as SupportScam:Win32/RogueMSP.MU!MTB. Once run, the installer registers RMM.Agent.exe and RMM.Agent.Launcher.exe as Windows services, adds registry autorun persistence, and creates a Windows Firewall rule permitting inbound UDP traffic to RMM.Agent.exe on port 48678. FaronicsDeployAgent.exe was observed in parallel activity as an alternative initial vector.

Using remote command execution through the MSP360 agent, the actors launch PowerShell to download ClientSetup.msi (ConnectWise ScreenConnect) and install it silently with msiexec.exe /qn, producing ScreenConnect.ClientService.exe and ScreenConnect.WindowsClient.exe connected to actor-controlled relay domains. This gives a second, redundant access channel that reduces dependence on any single tool. ScreenConnect file transfer and RunFile functionality are then used to stage and execute utilities from ScreenConnect\Temp folders under the user's Documents and OneDrive\Documents directories: credential-access tools (WindVerify.exe, WindowsUpdate.exe, WindowsSecurity_PIN.exe, WindowsPassKey.exe, Passwords.EXE, WebBrowserPassView.exe), defense-evasion tools (SCHider.exe, DefenderControl.exe, HideMouse.exe, HideFromControlPanel.exe) and information-gathering utilities.

Defenders should treat any unapproved RMM install as suspicious: enforce an allow-list of approved RMM tools with application control (AppLocker publisher rules, certificate blocking), require MFA on sanctioned RMM platforms, reset credentials of accounts that installed the detected services, and hunt for post-compromise credential theft. Microsoft published four KQL hunting queries covering MSP360 hash presence, MSP360-launched PowerShell/msiexec activity, ScreenConnect connections to malicious URLs, and RunFile payload drops.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.006 Web Services
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1218.007 Msiexec
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1036.005 Match Legitimate Resource Name or Location
- T1112 Modify Registry
- T1685 Disable or Modify Tools
- T1686 Disable or Modify System Firewall
- T1555.003 Credentials from Web Browsers
- T1219 Remote Access Tools
- T1071.001 Web Protocols

## Sources

- [Phishing Abuses RMM Tools for Persistent Access (Microsoft Security Blog)](https://www.microsoft.com/en-us/security/blog/2026/09/29/phishing-abuses-rmm-tools-persistent-access/)
- [Business-Themed Phishing Lures Deliver RMM Tools (KnowBe4)](https://blog.knowbe4.com/business-themed-phishing-lures-deliver-rmm-tools)
- [MITRE ATT&CK T1219 Remote Access Software](https://attack.mitre.org/techniques/T1219/)
- [MITRE ATT&CK T1566.002 Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
- [MITRE ATT&CK T1218.007 System Binary Proxy Execution: Msiexec](https://attack.mitre.org/techniques/T1218/007/)
- [MITRE ATT&CK T1583.006 Acquire Infrastructure: Web Services](https://attack.mitre.org/techniques/T1583/006/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3526