Hackers Exploit Windows Screensaver to Deploy RMM Tools, Gain Remote Access

## Executive summary A spear-phishing campaign is distributing Windows screensaver (.scr) files hosted on public file-sharing platforms; when executed, these PE-format files deploy legitimate RMM agents (such as SimpleHelp) to establish persistent, stealthy remote access. The report highlights evasion due to trust in RMM software and recommends blocking .scr execution from user-writable directories, allowlisting authorized RMMs, and monitoring for artifacts like unexpected scheduled tasks, services, or ProgramData folders.