Microsoft says attackers used phishing to install legitimate MSP360 remote-management software, then used it to deploy ScreenConnect as a second remote-access channel. The activity Microsoft observed in July 2026 involved abuse of trusted administration tools—not an observed exploit of ScreenConnect. That distinction matters: defenders need to verify whether each installation is authorized, not just whether its publisher is familiar.
What Microsoft observed
Microsoft Defender Experts reported phishing activity targeting organizations across multiple industries in July 2026. Microsoft published its analysis on September 29, 2026. The report does not name an actor or give a definitive victim count.
The attackers used lures themed around workplace meetings, Zoom or Google Meet installation prompts, Adobe Acrobat or PDF-reader updates, RSVP invitations and e-cards, job offers, document review or signatures, and package delivery. Links led through pages imitating document-sharing or collaboration services to downloads hosted on attacker-controlled infrastructure or legitimate cloud services. The downloads had deceptive names but included a legitimate, digitally signed MSP360 RMM v2.5.0.67 installer. Microsoft’s technical report details the observed chain.
How the dual-RMM chain worked
- A person followed a phishing link and downloaded a file presented as a business document, invitation, PDF, or software installer.
- The person ran the file and approved User Account Control (UAC) elevation. The legitimate MSP360 installer then installed services for persistent remote management.
- The MSP360 agent launched PowerShell, retrieved a ScreenConnect MSI, and installed it silently.
- ScreenConnect gave the operator a second remote-access path. Microsoft observed the channels being used to transfer and run further tools and conduct information collection and credential-access activity.
Microsoft also described separate July activity in which Faronics Deploy Agent was used as the initial management application before ScreenConnect was installed. This is a related observed pattern, not evidence that every intrusion followed the same sequence.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall#1 Best Overall
Why the distinction from a ScreenConnect exploit matters
Microsoft explicitly said it did not observe exploitation of ScreenConnect in this activity. The reported chain used legitimate remote-administration software and its normal management capabilities after a user ran the phishing payload and elevation succeeded. Treat this as unauthorized use of trusted tools, rather than evidence of a ScreenConnect software vulnerability.
Using two RMM products creates redundancy: if one management route is disrupted or noticed, another may still provide remote access. A valid digital signature, known product name, or allowed publisher therefore does not establish that a particular installation, account, or device is approved.
What defenders should check
Start with authorization and correlate endpoint evidence with management-console records. For every RMM agent, confirm its provider, business purpose, management account or tenant, and intended device set. MSP360’s October 2026 guidance for MSPs likewise recommends comparing endpoint and service inventories with deployment records and verifying account and purpose rather than relying on a familiar name or publisher.
- Look for unexpected MSP360, ScreenConnect, or other RMM installations, services, installer files, and devices not present in approved deployment records.
- Correlate RMM-agent-launched PowerShell with MSI downloads or installs, subsequent ScreenConnect activity, network connections, and files executed from ScreenConnect temporary directories.
- Compare the account or tenant controlling each agent with the organization’s approved provider and deployment records; investigate accounts used to install services.
- Review endpoint, network, and RMM-console telemetry together. A single familiar publisher or a single endpoint alert may not reveal the full two-agent sequence.
Microsoft lists this SHA-256 for the MSP360 installer observed in the campaign: 108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc. Use it as a campaign-specific hunting lead, not as a universal test for compromise. Microsoft’s report contains additional hashes, ScreenConnect-associated domains, Defender coverage, and Advanced Hunting queries; check that source for the full indicators and query text rather than relying on copied lists.
Recommended Free Tools
How to reduce the risk and respond
Govern approved RMM use
- Maintain an authorization inventory for each customer or organization: provider, purpose, management account or tenant, and covered devices.
- Require a documented owner and approval for new management agents, and reconcile installed agents against deployment records.
- Apply multifactor authentication to approved RMM systems where possible.
Restrict and monitor installation
- Use Windows application control or AppLocker publisher rules to restrict unapproved management software. Test policies for compatibility before broad deployment.
- Remember that a publisher rule can help control which software runs but does not identify which account controls a deployment. Pair software controls with account and tenant verification.
- Enable cloud-delivered endpoint protection and investigate suspicious installation, service creation, remote-management, PowerShell, MSI, and network activity.
If an unapproved agent is found
- Follow the incident-response process and preserve relevant endpoint, network, identity, and RMM-console evidence.
- Determine which accounts and devices the agents could access, what follow-on tools or files were run, and whether information was collected.
- Assess exposure of credentials, including accounts used to install the RMM services, and reset credentials as warranted by the investigation.
- Contain unauthorized access through the organization’s response procedures, then reconcile affected devices and accounts against the approved RMM inventory.
Microsoft’s guidance, including hunting queries and mitigation recommendations, is in its September 29 report. MSP360 says it blocked associated accounts and strengthened verification and monitoring; those vendor measures do not replace customer-side authorization and endpoint monitoring. The available reporting describes activity observed in July 2026 and does not establish whether the same infrastructure or campaign remained active on October 3, 2026.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
