Managed for Malice: How Attackers Turn MDM into Remote Access

Threat actors are abusing legitimate mobile device management (MDM) platforms such as Hexnode and Rippling by using social engineering techniques to trick users into enrolling devices or installing management agents. Once enrolled, attackers deploy unauthorized remote monitoring and management (RMM) tools like ScreenConnect, connecting to attacker-controlled relays to gain remote access. The MDM platforms themselves are not compromised but are misused through deception, making it difficult to distinguish legitimate from malicious activity.

• Fake Calendly "Meta Careers" pages steal Facebook and Google loginsCampaign2026-10-14
• RSVP to Disaster: How One Click Installs a RATMalware2026-10-13
• Locked and Loaded: Phishing through Fake Bids and Protected DocumentsCampaign2026-10-27
• How VBScript Malware Evades Detection Using Trusted Tools CopyMalware2026-10-27
• Tricks from the Past deployed via signed ChatGPT and Claude binariesMalware2026-10-27