Phishing Abuses RMM Tools for Persistent Access

In July 2026 Microsoft observed phishing campaigns that delivered a digitally signed, masqueraded MSP360 RMM installer which, after UAC elevation, established persistent MSP360 services and was used to download and silently install ConnectWise ScreenConnect as a secondary remote-access channel; attackers then used these legitimate remote-administration tools to deploy additional utilities for credential access, data collection, and to evade detection. The report provides an attack-chain overview, IOCs (hashes, domains, filenames), MITRE ATT&CK mappings, advanced-hunting queries, and mitigation and detection guidance.