Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks
-
Microsoft has issued a warning about phishing campaigns that deliver a legitimate installer for MSP360 Remote Monitoring and Management (RMM) software. The attacks rely on social-engineering lures such as fake meeting invitations, PDF-themed decoys, and software update prompts to trick users into running the installer.
According to the report, once executed, the legitimate MSP360 installer — distributed under a deceptive file name — established remote management access on the affected system. The campaign is notable for its dual-RMM approach: after gaining a foothold via MSP360, the attackers were observed deploying ScreenConnect as a second remote access tool.
Key points from the reporting:
- Attackers distribute a genuine, signed MSP360 RMM installer rather than custom malware, which can help evade detection.
- Lures include meeting invitations, PDF-themed content, and software update prompts.
- The installer is given a deceptive file name to appear benign.
- Successful execution grants remote management access to the victim machine.
- ScreenConnect is then deployed as an additional RMM tool, creating a dual-RMM foothold.
Because the tooling involved is legitimate software, defenders should focus on monitoring for unauthorized RMM installations, unusual remote-management traffic, and installer executions that do not match approved software deployment processes.
Source: The Hacker News
Has your organization seen unexpected RMM installers like MSP360 or ScreenConnect appearing outside of approved deployment channels?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login