Recommended Free Tools
A July 2026 phishing campaign used a legitimate MSP360 remote monitoring and management (RMM) installer to establish access to victim systems, then used the MSP360 agent to install ConnectWise ScreenConnect as a second remote-access channel. Microsoft reported abuse of legitimate software—not exploitation of a ScreenConnect vulnerability—and did not attribute the activity to a named group.
How the phishing campaign reached users
Microsoft Defender Experts said they observed the activity in July 2026 across organizations in multiple industries. The lures imitated routine business tasks and software workflows, including meeting invitations, document sharing and signature requests, PDF or Adobe themes, Zoom and Google Meet installation prompts, job offers, e-cards, and delivery notifications. Deceptive filenames included VIP_ECARD_INVITATION, ZoomSetup_Installation, and PDF Reader & Editor the Adobe Acrobatte.
As an Amazon Associate I earn from qualifying purchases.
Many of the analyzed samples contained the same legitimate, digitally signed MSP360 RMM v2.5.0.67 installer. Microsoft said payloads were hosted on attacker-controlled or compromised sites and on cloud services including Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase. The use of legitimate software and familiar delivery services can make a download look less unusual; neither a valid signature nor a reputable hosting provider establishes that a particular installation is authorized.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How MSP360 and ScreenConnect formed a two-channel foothold
- The user ran the downloaded file. The phishing lure led the recipient to execute the deceptive business-themed installer.
- The installation gained elevation. After successful User Account Control (UAC) elevation, the installer deployed MSP360 components and registered services, creating persistent remote-management access.
- The MSP360 agent installed ScreenConnect. Microsoft observed the agent invoke PowerShell to retrieve and silently install ConnectWise ScreenConnect, giving the operators a second remote-access channel.
- The operators used the remote channels for follow-on activity. Microsoft described transferring and running additional tools for information collection, credential access, and other post-compromise operations.
Redundancy matters: removing or interrupting one remote-access product may not end access if another channel remains. Microsoft also described separate July activity in which FaronicsDeployAgent.exe was used to install ScreenConnect; that is a distinct observed activity, not another step in the MSP360 chain. The campaign was unattributed. (Microsoft Security Research, September 29, 2026: Phishing Abuses RMM Tools for Persistent Access.)
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
What the indicators can—and cannot—tell defenders
Microsoft reported the following campaign-specific leads:
- MSP360 version: RMM v2.5.0.67.
- SHA-256:
108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc. - Installation behavior: MSP360 services were registered; observed behavior included an inbound Windows Firewall rule for the MSP360 agent on UDP port 48678.
These are leads for investigating the reported activity, not universal signatures of malicious RMM use. Organizations may legitimately deploy MSP360 or ScreenConnect, so the key questions are whether the installation was approved, who authorized it, which account elevated it, and whether its subsequent process and network activity matches the organization’s expected use.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Microsoft’s report includes Defender hunting queries for the installer hash, PowerShell launched by the MSP360 agent, ScreenConnect network activity in that process chain, and files executed through ScreenConnect RunFile. Consult the report for the queries and use them with the appropriate environment-specific review: Microsoft’s campaign analysis and hunting guidance.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesHow to reduce the risk of unauthorized RMM access
- Maintain an approved RMM inventory. Define which tools and versions are allowed, who may install them, and which teams or devices they may manage. Compare new agent and service installations against that governed list.
- Require MFA for approved RMM access where possible. Apply it to accounts and management consoles used for remote administration, and review accounts that can authorize or install agents.
- Block unapproved management software. Microsoft recommends Windows Application Control or AppLocker publisher rules to prevent unauthorized IT management tools from running. Signed software is not automatically trusted for every device or user; publisher controls need to reflect the organization’s approved applications.
- Monitor installation and process chains. Investigate unexpected RMM services, agent-launched PowerShell, ScreenConnect activity tied to an installer or agent, and remote-tool file execution. Combine endpoint and network telemetry with the approved-tool inventory so legitimate administration can be distinguished from unapproved access.
- Strengthen endpoint protection and investigate deviations. Alert on unexpected remote-management installations and service changes, then examine the related account, parent process, downloaded files, connections, and actions performed through the remote session.
These controls address the underlying exposure: RMM tools legitimately support remote command execution, software deployment, file transfer, and persistent service access. Those same capabilities make unauthorized installations consequential. CISA, NSA, and MS-ISAC also warned about malicious use of RMM software in their 2023 advisory: Protecting Against Malicious Use of Remote Monitoring and Management Software.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
What to do if you find an unauthorized installation
- Establish scope. Identify the host, RMM product and version, installation time, registered services, firewall changes, related processes, and any ScreenConnect deployment or activity. Check whether another remote-access channel was installed.
- Review the installing account and elevation. Determine which user or system account installed or elevated the software and whether that use was expected. Microsoft recommends resetting passwords for accounts used to install RMM services; use your incident-response process to assess the account and connected credentials. Microsoft notes that system-account use may warrant further investigation.
- Contain unauthorized access. Follow your incident-response procedures to disable or isolate unapproved remote-access paths while preserving evidence and maintaining authorized support coverage. Removing one agent alone may not address a second channel.
- Investigate follow-on actions. Review relevant endpoint and network telemetry for agent-launched PowerShell, ScreenConnect network activity, remote file execution, credential-access activity, and other tools or changes associated with the access.
What this report establishes about scale and related activity
Microsoft’s September 29 report describes activity across multiple industries, but does not provide a campaign-wide victim count, prevalence estimate, or named impact statistic. The version and hash above identify technical artifacts; they are not measures of how many organizations were affected.
A separate Microsoft report published September 2, 2026 describes attackers impersonating helpdesk staff through Teams and persuading users to grant interactive remote sessions, followed by MSI delivery, per-user persistence, reconnaissance, and lateral movement. It is useful context for the broader risk of remote access, but Microsoft’s September 29 report does not establish that the July RMM campaign used that helpdesk-impersonation route. See Impersonating IT support: how threat actors turn a remote session into enterprise-wide access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
