{"id":3279,"date":"2026-09-30T18:58:53","date_gmt":"2026-09-30T18:58:53","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3279"},"modified":"2026-09-30T18:58:53","modified_gmt":"2026-09-30T18:58:53","slug":"attackers-abuse-msp360-to-deploy-screenconnect-in-dual-rmm-phishing-attacks","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3279","title":{"rendered":"Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 30, 2026<\/span><\/span>Endpoint Security \/ Social Engineering<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content.<\/p>\n

\u00abOnce executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected devices and enabled threat actors to gain an initial foothold using trusted administrative software,\u00bb the Microsoft Security Research team said<\/a>.<\/p>\n

The initial foothold is then used to download and install a ConnectWise ScreenConnect client, offering threat actors a redundant remote-access channel to compromised endpoints. The access is then abused to deliver additional tools and carry out information collection and credential-access operations. The activity has not been attributed to any known threat actor or group.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The multi-stage intrusion chain, which the Windows maker detected in July 2026, begins with phishing emails distributing a digitally signed MSP360 RMM v2.5.0.67 installer under deceptive names such as below –<\/p>\n

<\/p>\n