Topic
Attackers installing commercial remote monitoring and management agents to obtain durable interactive control of hosts.
Phishing emails carrying fake PDF invoices are installing Action1's remote-management agent, SANS ISC handler Xavier Mertens reported. It follows a ScreenConnect campaign he documented a few days earlier that used the same fake-invoice lure.
Reality
Microsoft says phishing emails seen in July 2026 deliver a signed MSP360 remote-management installer that then installs ConnectWise ScreenConnect. The chain uses no exploit, only a user's click and features the two admin tools ship with.
Perspective Coverage
3 publishersReality
ANY.RUN tied 351 sandbox analyses to CSuite, a phishing operation that steals Microsoft 365 sessions or installs ScreenConnect or Action1 for remote access. Resetting credentials leaves the remote-access half of an intrusion in place.
Reality
Google Threat Intelligence and Mandiant put the Brazilian crew's route to Pix and STR at password spraying plus a fake IT support call, which means the controls that bite here are RMM allow-listing and out-of-band verification of the help desk.
Reality
ConnectWise's September 3 advisory promises a CVE and a fix within the week, so until one lands the only control is a per-role permission change. Huntress says the spread is already worm-like across newly connected machines.
Perspective Coverage
3 publishersReality
Huntress traced a September 2026 intrusion in which the actor compiled a Monero miner on the endpoint, using a MagicINFO flaw Samsung fixed 16 months earlier. The build step is loud in telemetry, but it ran only after Defender had been disabled.
Reality
Trinity Cyber's deception workstation caught the same operator installing ScreenConnect from a batch file, reaching into LSASS by hand, then dropping FormBook into a signed binary. Two detection teams usually own those halves separately.
Reality
Microsoft's Defender team cannot say which of three SolarWinds flaws opened the door, because the December hosts were vulnerable to all of them, which makes the exposure list more useful than the patch list.
Reality