Microsoft has described a set of large-scale phishing campaigns that trick users into installing legitimate, digitally signed remote monitoring and management software, giving attackers durable remote access to their machines, according to a Microsoft Threat Intelligence blog post published Tuesday. The activity was observed in July 2026 across multiple industries.

What Happened

Microsoft Defender Experts found the campaigns relied mainly on MSP360 RMM, version 2.5.0.67, and ConnectWise ScreenConnect. In separate but similar activity, attackers used a Faronics deployment agent in the same way. Microsoft has not attributed the campaigns to a named threat actor and tracks them as unattributed.

The lures covered a wide range of everyday pretexts: workplace meeting requests, prompts to install Zoom or Google Meet, Adobe Acrobat and PDF reader updates, RSVP invitations and e-cards, job offers, document review requests and DHL delivery notices. The RMM installer was renamed to match, with filenames built around phrases such as a VIP e-card invitation or a Zoom setup file.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

Payloads were hosted on attacker-controlled domains and compromised websites, as well as on legitimate services including Amazon S3, Cloudflare R2, Dropbox, GitLab and Supabase. Using mainstream platforms let the operators swap download locations quickly.

How the Intrusion Unfolds

The installer required User Account Control elevation. When a victim declined the prompt, the installation ended before any persistence was set up, Microsoft said.

When the user approved it, the MSP360 agent installed its services, then launched PowerShell to download a ScreenConnect installer and install it silently. That gave the attackers a second, redundant remote-access channel.

Through ScreenConnect, the operators staged more than two dozen additional utilities. They included browser password viewers and other credential-access tools, a tool for disabling Microsoft Defender, and utilities whose names point to hiding the mouse cursor, on-screen banners and the ScreenConnect session itself. Several files were named to resemble Windows, Defender, Phone Link and other security components.

For persistence, the attackers relied on two Windows services tied to the RMM agent, registry autorun entries and an inbound firewall rule allowing UDP traffic on port 48678. Microsoft Defender Antivirus detects the samples as SupportScam:Win32/RogueMSP.MU!MTB.

Why It Matters

RMM software is built to provide remote control and is signed by its vendors, so it often looks legitimate to antivirus tools and to IT staff reviewing installed programs. By delivering a genuine product rather than custom malware, attackers can gain the same access an IT administrator would have without triggering the detections that a remote access trojan might.

The Defender detection name places this activity alongside tech support scams, and the combination of credential-stealing tools with two remote channels gives operators options to return even if one channel is found and removed.

What Microsoft Recommends

Microsoft advises organizations to maintain an approved list of RMM tools and enforce multifactor authentication on them, block unapproved RMM software through Application Control or AppLocker, and use certificate-based blocking for specific signed applications. It also recommends hunting for unauthorized RMM installations, enabling cloud-delivered protection in Defender Antivirus and applying attack surface reduction rules.

What to Watch

Microsoft did not disclose how many organizations were affected. Because the campaigns reuse legitimate software and rotate hosting quickly, defenders will need inventories of the remote tools actually in use; indicators alone will age fast. The UAC prompt proved to be the point at which a cautious user stopped the attack, which makes limiting local administrator rights a practical control.