RMM tools currently being distributed through phishing attacks (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able)

In January 2026 ASEC reported multiple active campaigns distributing legitimate RMM tools (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able) via phishing pages, malicious attachments and disguised installers to obtain remote access; the report includes observed filenames, installation arguments (deploymentID, CONNECT_KEY, AccountUid), configuration artifacts, MD5 hashes, sample URLs and domains, and notes linkage to ransomware/APT activity (e.g., Scattered Spider/DragonForce, Play, Medusa, ALPHV/BlackCat).