Microsoft says phishing campaigns observed in July used a disguised MSP360 installer to gain remote access to victims’ devices, then installed ConnectWise ScreenConnect as a second access channel. The key lesson for defenders is that legitimate remote-management software can be turned into a foothold, without the software itself being exploited.
Watch Desk analysis
What happened
The campaigns targeted organisations across several industries, using lures dressed up as meeting invitations, PDF documents and software updates. Microsoft says victims were directed to download a digitally signed MSP360 installer under deceptive filenames. After installation, attackers used it to deploy ScreenConnect and then transferred and ran additional tools, including utilities associated with credential access and information collection.
The attackers also used other legitimate remote-management software in separate activity. Microsoft says it did not observe exploitation of ScreenConnect itself. Read Microsoft’s analysis.
What we know
- A familiar installer was disguised
Microsoft says the MSP360 installer was presented as business documents, meeting invitations and software updates. - A second remote-access channel followed
The attackers used MSP360 to install ScreenConnect, giving them another way to control compromised devices. - The software was abused, not exploited
Microsoft says it did not observe attackers exploiting ScreenConnect itself.
Why it matters
Remote-management tools are built to let administrators run commands, deploy software and manage devices. In the wrong hands, those same capabilities can make malicious activity look like routine IT work. A familiar product name or a valid digital signature is not, by itself, proof that an installer is safe.
Our read
This is a useful reminder to treat unexpected installers with suspicion, even when they appear to come from a legitimate software vendor. The notable detail is the chain: phishing, one trusted remote-management tool, then another. That can leave defenders chasing what looks like ordinary administration rather than a single obvious malicious programme.
What to watch
- Whether organisations can identify unapproved remote-management tools across their devices.
- Whether Microsoft publishes further detail on affected organisations or the campaign’s reach.
- Whether attackers continue switching between legitimate remote-access products to evade detection.
Discussion spark: Should organisations block remote-management tools unless they are explicitly approved, or does that create too much friction for legitimate IT work?
Sources and evidence
- Phishing Abuses RMM Tools for Persistent Access – Microsoft (29 September 2026, 21:39 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.