Phishing Abuses RMM Tools for Persistent Access

In July 2026, phishing campaigns targeted organizations across multiple industries by distributing a masqueraded MSP360 Remote Monitoring and Management installer through meeting invitations, PDF-themed lures, and software update prompts. Once executed, the legitimate MSP360 installer established remote management access on affected devices, providing threat actors with an initial foothold using trusted administrative software. The MSP360 deployment was then used to download and install a ConnectWise ScreenConnect client, creating a secondary remote-access channel for redundant access to compromised systems. Following access establishment, threat actors deployed additional tools and conducted post-compromise activity, including information collection and credential-access operations. The campaigns utilized multiple delivery mechanisms including actor-controlled domains, compromised websites, and legitimate cloud services such as Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase.

• SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of EndpointsMalware2026-11-12
• Grand Theft Auto VI Release Phishing LuresMalware2026-11-05
• Fake Zillow pages use ClickFix NetSupport RAT to target apartment huntersMalware2026-11-13
• Stolen webcam clips of 900+ victims feed North Korea's $400 million fake Zoom schemeCampaign2026-11-13
• Luna Moth Returns, Re-Targeting Law Firms Through Access TokensCampaign2026-11-12