Phishing that installs legitimate remote control tools: MSP360 and ScreenConnect
An email campaign delivers a signed, legitimate MSP360 RMM installer disguised as a document and then uses it to install ScreenConnect as a second remote access channel.
What happened
The emails carry a signed MSP360 RMM installer presented as a meeting invitation, a PDF reader, a Zoom installer or a statement. The file is also hosted on legitimate services such as Amazon S3, Cloudflare R2, Dropbox, GitLab or Supabase. Once run, MSP360 installs ConnectWise ScreenConnect as a second remote access channel. Microsoft also saw a variant using Faronics Deploy Agent. The campaign is not attributed to any known group.
Why it matters
The tool being installed is legitimate and signed, so it does not trip malware detection: what is wrong is who runs it and what for. With two remote access channels the attacker keeps the session even if one of them is closed, and the door stays open while nobody notices the application. That the file is served from trusted services makes blocking by domain reputation harder, because the domain is not the problem.
What we recommend
Keep a list of authorised remote administration tools and detect and block all the others. It is worth reviewing which remote access applications are installed on devices today and who approved them, because in a large workforce there are always old installations nobody remembers making. And explain to users that a "PDF reader" asking to install itself is never a PDF reader.
Related service: soc-gestionado · Digital Workplace
Want to know how it affects you?
We review your environment and tell you what to prioritise, with no commitment.