Hackers Disguise Remote Access Tools as Zoom and PDF Installers to Take Over PCs
Hackers phish employees with fake Zoom and PDF installers that deploy signed MSP360 and ScreenConnect access.
72
Product
ConnectWise ScreenConnect
- Mentions · 7d0
- Mentions · 30d0
- All mentions4
- First seenSep 11, 2026
- Last mentionedSep 30, 2026
Timeline
4 articles · newest firstPhishing Abuses RMM Tools for Persistent Access
Microsoft observed July 2026 phishing campaigns that installed MSP360 RMM and ScreenConnect for persistent access across industries.
71
AgtaBackup RAT Uses Fake Microsoft Store Pages and RMM Tools to Hijack Windows Systems
AgtaBackup RAT uses fake Microsoft Store pages and legitimate RMM tools to steal data from Windows systems.
72
CISA Adds Three Known Exploited Vulnerabilities to Catalog
CISA added three actively exploited vulnerabilities — two JFrog Artifactory and one ConnectWise ScreenConnect — to its KEV Catalog.
78
Related CVEs
by mentions- CVE-2026-84869<1%9.9Missing authorization in ScreenConnect client allows unauthorized file execution
- CVE-2026-420169%8.8Token Scope Validation Flaw Enables Privilege Escalation in JFrog Artifactory
- CVE-2026-4201810%7.5Improper Authentication in JFrog Artifactory Exposes Internal Anonymous Tokens
Appears with
- ConnectWisevendor · 4
- Microsoftvendor · 3
- Windowsproduct · 2
- MSP360 RMMproduct · 2
- MSP360vendor · 2
- Microsoftorganization · 2
- Palo Alto Networksvendor · 1
- Supabaseorganization · 1
- AgtaBackup RATmalware · 1
- ConnectWiseorganization · 1
- Zoomproduct · 1
- JFrogvendor · 1
- Palo Alto Networks Unit 42organization · 1
- Microsoft Defender for Endpointproduct · 1
- Dropboxorganization · 1
- MSP360organization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.