New Phishing-to-RMM Attacks: How Analysts Can Detect Trusted-Tool Abuse Early 

ANY.RUN researchers detail a phishing-to-RMM campaign where attackers impersonate Microsoft/OneDrive/Adobe pages to trick users into downloading legitimate remote-management tools (ScreenConnect, LogMeIn Rescue, etc.) or VBS scripts that weaken Defender/SmartScreen and install unattended remote access. The report presents multiple case analyses, notable filenames and domains, and recommendations for triage and behavioral sandboxing to distinguish legitimate admin tools from abuse.