Microsoft says attackers used phishing to install legitimate MSP360 RMM software and then deploy ConnectWise ScreenConnect, creating two remote-access routes into targeted devices. The company reported abuse of trusted administration tools—not an observed vulnerability or exploit in ScreenConnect. Its analysis, published September 29, 2026, describes activity seen in July 2026.
How the dual-RMM phishing chain worked
Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries. Messages used business-themed lures, including meeting requests, Zoom or Google Meet installation prompts, Adobe Acrobat or PDF-reader updates, RSVP invitations and e-cards, job-offer documents, document review or signature requests, and package-delivery notices.
As an Amazon Associate I earn from qualifying purchases.
Links led to pages imitating document-sharing or collaboration services, then to downloads hosted on attacker-controlled infrastructure or legitimate cloud services. The deceptive filenames disguised a legitimate, digitally signed MSP360 RMM v2.5.0.67 installer. After a victim ran it and User Account Control (UAC) elevation succeeded, MSP360 services were installed for persistent remote management.
Microsoft observed the MSP360 agent launching PowerShell to retrieve a ScreenConnect MSI and install it silently. ScreenConnect added a second remote-access channel. The operators used the two tools to transfer and run additional tools and conduct information collection and credential-access activity. Microsoft’s account and technical findings are in its September 29, 2026 analysis.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why attackers added ScreenConnect
The second RMM provided a redundant route for remote administration after MSP360 established the initial foothold. A second agent can make access more resilient if one route is removed or disrupted; its presence also means defenders should investigate the relationship between management tools, not treat each installation in isolation.
What Microsoft did—and did not—report
Microsoft explicitly said it did not observe exploitation of ScreenConnect itself in this activity. The reported technique was phishing followed by installation and abuse of legitimate remote-management software. Microsoft has not attributed the campaigns to a named actor.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft also described separate July activity in which Faronics Deploy Agent was used as the initial management application before ScreenConnect was installed. This is a related observed pattern, not evidence that every intrusion followed the same sequence.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What defenders should investigate
Start with authorization, not the product name. A legitimate publisher, familiar filename, or valid signature does not establish that a particular installation belongs in your environment. For each approved RMM deployment, maintain an inventory that identifies the provider, purpose, management account or tenant, and devices in scope. MSP360 makes similar recommendations in its October 2026 guidance for MSPs.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Compare endpoint software and service inventories with approved deployment records. Identify MSP360, ScreenConnect, Faronics Deploy Agent, and other RMM software that lacks a known owner, purpose, tenant, or device assignment.
- Correlate endpoint files and services with process, PowerShell, MSI, and network events. In particular, investigate an RMM agent launching PowerShell, downloading or installing another remote-management tool, and subsequent ScreenConnect activity.
- Review RMM-console records alongside endpoint evidence. Confirm which account or tenant initiated the deployment and whether the device was supposed to be managed.
- Inspect follow-on activity for information collection, credential access, and tools or files run through ScreenConnect, including activity in ScreenConnect temporary directories.
- Use Microsoft’s article for its full indicator list and Advanced Hunting queries, which cover the installer, process chain, suspicious network connections, and files executed through ScreenConnect. The reported MSP360 installer SHA-256 is
108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc. Treat hashes and domains as campaign indicators with a limited time window, not as universal proof of compromise.
How to reduce the risk of unauthorized RMM access
- Require multifactor authentication for approved RMM systems where possible, and verify that management accounts and tenants are controlled by the expected provider or internal team.
- Restrict unapproved management software with Windows application control or AppLocker publisher rules. Test policy compatibility before deployment; a publisher rule can help restrict software but does not identify which account controls a given deployment.
- Enable cloud-delivered endpoint protection and investigate alerts involving suspicious RMM installation, service creation, PowerShell, MSI execution, or remote-management activity.
- Review approved-tool inventories regularly against endpoint and service records. Investigate unexpected installations even when the software is signed and comes from a recognized vendor.
What to do if you find a rogue installation
- Follow your incident-response process and preserve relevant endpoint, network, identity, and RMM-console evidence.
- Determine the scope of access: identify affected devices, the accounts and tenants used to install or operate the tools, any second RMM channel, and follow-on tools or activity.
- Assess whether credentials may have been exposed, including credentials used to install the RMM software. Reset or otherwise contain accounts as warranted by the investigation.
- Remove or disable unauthorized access as part of the response, while preserving evidence and coordinating with the legitimate service provider where needed.
- Reconcile the affected deployment against the authorization inventory and close the gap in ownership, account control, or device coverage that allowed it to go unnoticed.
Microsoft’s public report describes activity observed in July 2026 and does not provide a definitive victim count. It does not establish whether the same infrastructure or activity remained active on October 3, 2026, so the indicators should not be read as confirmation of current campaign status.
Quick Recap
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
