Phishing campaign uses signed MSP360 installers to plant ScreenConnect as a backup channel
Microsoft says phishing emails seen in July 2026 deliver a signed MSP360 remote-management installer that then installs ConnectWise ScreenConnect. The chain uses no exploit, only a user's click and features the two admin tools ship with.
The Watch · Security desk
What happened
- The lures posed as meeting invitations, PDF documents and software update prompts, among other social-engineering themes.
- The installers were staged on attacker-controlled servers and on Amazon S3, Cloudflare R2, Dropbox, GitLab and Supabase.
- The attackers used the access to deliver more tools and to run information collection and credential-access operations.
- A separate set of attacks in July 2026 used Faronics Deploy Agent in place of MSP360, then installed ScreenConnect through it.
- Microsoft has not attributed the activity to any known threat actor or group.
Why it matters
- What it limits constraint Controls that trust signed, reputable binaries let the first stage run. The misleading file name is the only part a filter could flag.
- What it sets up precedent The operators have already swapped the first-stage tool once, so a block on any single named RMM product covers one variant at most.
- What it costs cost Removing whichever agent a responder finds first leaves the other channel open, so cleanup has to cover both products and the persistence each one set up.
Next story · Leadership · 5d ago
Calendar phishing reaches staff through auto-added invites even when the email lands in spamConfirmed2 publishers
The binary at the front of the chain is a digitally signed MSP360 RMM v2.5.0.67 installer [5]. Only the names are fake: ZoomSetup_Installation, SSA.GOV_STATEMENT, VIP_ECARD_INVITATION and "PDF Reader & Editor the Adobe Acrobatte", each with the real version string attached [6]. "Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected devices and enabled threat actors to gain an initial foothold using trusted administrative software," the Microsoft Security Research team said [3].
On the endpoint, the installer drops several DLLs and relaunches itself through the Windows UAC elevation workflow to run privileged [8]. It enumerates installed .NET runtimes, registers two services, RMM.Agent.exe and RMM.Agent.Launcher.exe, and writes Registry autorun entries so MSP360 starts at every user sign-in [10]. It opens Windows Firewall to inbound UDP traffic on port 48678 for RMM.Agent.exe [11]. Then it uses the MSP360 agent to run PowerShell, and that PowerShell installs ScreenConnect [2]. Later payloads go through ScreenConnect's native RunFile function [4].
"The combination of MSP360 and ScreenConnect provided the threat actor with redundant remote administration channels and enabled the transfer, execution, and management of additional tooling during subsequent stages of the intrusion," Microsoft said [9]. Across the two July sets, the first-stage tool changed from MSP360 to Faronics Deploy Agent, and ScreenConnect was the second stage both times [18]. Microsoft placed the campaign in a continuing pattern. "This activity highlights how threat actors continue to abuse legitimate remote administration software to blend into normal IT operations while maintaining persistent access and reducing detection opportunities," the company said [15].
The Hacker News report does not list Microsoft's recommended mitigations [16]. In my view the control that fits is an allowlist of the RMM products an organisation actually runs. Neither July first stage gets past it unless MSP360 or Faronics Deploy Agent is already sanctioned on that network [19]. Where one of them is, the next check is a second RMM agent arriving on a host that already has one, or an RMM agent process spawning PowerShell that installs another remote-access client [2]. The inbound UDP 48678 rule is a narrower indicator, specific to the MSP360 agent in this campaign [11].
What to watch
- Attribution of either July set to a named group would show whether the MSP360 and Faronics waves are one operator's playbook or tradecraft shared across crews.
- A third signed RMM product turning up ahead of ScreenConnect would confirm the first stage rotates by design.
- Any move to revoke or restrict the signature on the MSP360 v2.5.0.67 build would change what a signature check sees.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+5
- Incentives35
- Confidence72
Perspective Coverage
3 publishers- Builder
- Builder 18%
- Operator
- Operator 77%
- Investor
- Investor 5%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Microsoft warned of phishing campaigns distributing an installer for MSP360 RMM software under the guise of meeting invitations, PDF-themed lures, software update prompts and other social-engineering content.
- [2]
The installer uses the MSP360 RMM tool to execute PowerShell that stealthily installs a ConnectWise ScreenConnect client, giving a redundant remote-access channel.
- [3]
"Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected devices and enabled threat actors to gain an initial foothold using trusted administrative software,"
- [4]
Payloads are run through ScreenConnect's native RunFile functionality.
- [5]
The intrusion chain, detected by Microsoft in July 2026, begins with phishing emails distributing a digitally signed MSP360 RMM v2.5.0.67 installer under deceptive names.
- [6]
Deceptive file names include VIP_ECARD_INVITATION_rmm_v2.5.0.67, ZoomSetup_Installation_v2.5.0.67, PDF Reader & Editor the Adobe Acrobatte_rmm_v2.5.0.67, RSVP_INVITATION_E_CARD_rmm_v2.5.0.67 and SSA.GOV_STATEMENT_rmm_v2.5.0.67.
- [7]
The installer packages are staged on attacker-controlled infrastructure and legitimate cloud services including Amazon S3, Cloudflare R2, Dropbox, GitLab and Supabase.
- [8]
Once launched, the installer drops multiple DLLs and relaunches itself by invoking the Windows UAC elevation workflow to run in a privileged context.
- [9]
"The combination of MSP360 and ScreenConnect provided the threat actor with redundant remote administration channels and enabled the transfer, execution, and management of additional tooling during subsequent stages of the intrusion."
- [10]
The installer enumerates installed .NET runtimes, registers two Windows services (RMM.Agent.exe and RMM.Agent.Launcher.exe) and creates Registry-based autorun entries so MSP360 launches when users sign in.
- [11]
The installer modifies the Windows Firewall configuration to allow inbound UDP traffic to RMM.Agent.exe on port 48678.
- [12]
The access is abused to deliver additional tools and carry out information collection and credential-access operations.
- [13]
The activity has not been attributed to any known threat actor or group.
- [14]
Microsoft observed a separate set of attacks in July 2026 that used Faronics Deploy Agent instead of MSP360 for initial access, then used it to download and install ScreenConnect.
- [15]
"This activity highlights how threat actors continue to abuse legitimate remote administration software to blend into normal IT operations while maintaining persistent access and reducing detection opportunities,"
- [16]
The Hacker News report quotes Microsoft's findings and does not list recommended mitigations.
- [17]
Because the first-stage MSP360 installer is digitally signed, legitimate software, controls that trust signed or reputable binaries would let it run; the deceptive file name is the only obviously malicious element.
- [18]
Across the two July 2026 sets Microsoft described, the first-stage RMM tool changed (MSP360, then Faronics Deploy Agent) while the second stage was ScreenConnect in both.
- [19]
An allowlist limited to an organisation's sanctioned RMM products blocks both observed first-stage tools unless that organisation already sanctions MSP360 or Faronics Deploy Agent.
Sources
3 independent publishers whose own reporting we read for this story.
- microsoft.comPhishing Abuses RMM Tools for Persistent Access
1 article · September 29, 2026
- thecyberexpress.comMSP360 RMM Abused in Phishing Campaigns to Deploy ScreenConnect
1 article · October 1, 2026
- thehackernews.comAttackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks
1 article · September 30, 2026