MSP360 RMM Abused in Phishing Campaigns to Deploy ScreenConnect

Microsoft Defender Experts tracked July 2026 phishing campaigns that delivered a legitimately signed MSP360 RMM installer via meeting invites, PDF-themed lures, software-update prompts, and other social-engineering baits; when elevated the installer created RMM services, then silently downloaded and installed a ConnectWise ScreenConnect client to provide a redundant attacker access channel. The attackers used cloud-hosted infrastructure and compromised/actor domains to rotate hosting, staged a variety of tools (many imitating Windows/security components) to collect credentials and data while blending into routine IT activity, and Microsoft recommends enforcing MFA on RMM tools, blocking unapproved RMMs, hunting for unauthorized installs, and using application control and Defender protections to mitigate risk.