Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks
Phishing campaigns abuse signed MSP360 installers to deploy ScreenConnect and establish dual remote-access footholds.
66
Vendor
Faronics
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenAug 31, 2026
- Last mentionedSep 30, 2026
Timeline
2 articles · newest firstDaisy-Chaining Trust: Investigating Faronics Deploy Abuse
Actors abuse Faronics Deploy in phishing campaigns to run PowerShell and deploy ScreenConnect while evading detection with trusted tools.
55
Appears with
- ConnectWisevendor · 2
- ScreenConnectproduct · 2
- Faronics Deploy Agentproduct · 1
- Huntressvendor · 1
- Microsoftorganization · 1
- MSP360vendor · 1
- MSP360product · 1
- Faronics Deployproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.