Surge in Phishing Attacks Using RMM Tools Targeting Financial Institutions

Cybercriminals have sharply increased phishing campaigns that leverage legitimate RMM tools (e.g., AnyDesk), with a reported 475% rise in such attacks in the first nine months of 2026 versus all of 2025; these campaigns focus on North American financial institutions and commercial banking customers. Attackers trick victims into installing RMM software to gain persistent access, monitor activity, steal credentials, and deploy additional malware; CISA has warned about malicious RMM use and organizations are advised to enforce strict approved-software controls.