MSP360 RMM Phishing Campaign Deploys ScreenConnect for Persistent Access
In July 2026, Microsoft Defender Experts observed sophisticated phishing campaigns targeting multiple industries that distributed legitimate MSP360 Remote Monitoring and Management (RMM) software under deceptive filenames. Threat actors used social engineering themes including meeting invitations, PDF updates, and software installation prompts to trick victims into executing the masqueraded installer. Once deployed, the MSP360 RMM established persistent access and was used to download and install ConnectWise ScreenConnect, creating redundant remote access channels for credential harvesting, information collection, and follow-on malicious activities. This incident highlights the growing trend of threat actors abusing legitimate remote administration tools to blend into normal IT operations while maintaining persistent access. As organizations increasingly rely on remote management solutions, attackers are exploiting the inherent trust and broad privileges these tools possess to evade detection and establish durable footholds in enterprise environments.
Kill Chain
