Phishing abuses RMM tools for persistent access

Introduction

Microsoft has detailed a phishing campaign that shows how legitimate remote monitoring and management (RMM) tools can be turned into a stealthy persistence mechanism. For IT and security teams, this matters because the software involved is trusted, signed, and commonly used in enterprise environments—making abuse harder to spot than traditional malware.

What’s new

In July 2026, Microsoft Defender Experts observed phishing campaigns targeting multiple industries. The attackers delivered a legitimate MSP360 RMM installer under deceptive filenames and themes such as:

• Meeting invitations
• Zoom or Google Meet install prompts
• Adobe/PDF reader updates
• Document review or signature requests
• RSVP and e-card lures
• Package delivery notifications

After a user executed the file and approved UAC elevation, the installer:

• Installed MSP360 RMM for persistent remote access
• Registered Windows services for long-term foothold
• Added autorun entries for user sign-in persistence
• Created a Windows Firewall allow rule for the RMM agent
• Used PowerShell to download and silently install ConnectWise ScreenConnect

Microsoft noted that attackers did not exploit a vulnerability in ScreenConnect. Instead, they abused legitimately obtained remote administration software to create a second remote-access channel.

Why this matters for administrators

This campaign reinforces a growing problem: threat actors are blending into normal IT activity by using approved or familiar admin tools instead of custom malware.

For defenders, that creates several challenges:

• Signed installers can appear trustworthy to users and security controls
• RMM traffic may resemble legitimate remote support activity
• Multiple remote-access tools on one endpoint can provide redundant persistence
• Post-compromise actions such as credential access and data collection may happen through tools already allowed in the environment

Organizations that do not tightly govern which RMM products are approved may struggle to distinguish sanctioned use from attacker activity.

Recommended next steps

Security and endpoint teams should review Microsoft’s guidance and hunting queries from the original research. Practical actions include:

• Audit and inventory approved RMM tools across the environment
• Block or restrict unapproved RMM software through application control
• Monitor for uncommon or newly installed remote administration tools
• Investigate endpoints running both MSP360 and ScreenConnect unexpectedly
• Review phishing protections for software update and meeting-invite lures
• Use Microsoft Defender for Endpoint detections for suspicious RMM behavior

Bottom line

This campaign is a reminder that legitimate admin tools can become an attacker’s persistence layer when introduced through phishing. IT teams should treat unexpected RMM installations as high-risk activity and enforce stricter controls around remote management software.