MSP360 (Vendor): news timeline & CVEs

Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks

Phishing campaigns abuse signed MSP360 installers to deploy ScreenConnect and establish dual remote-access footholds.

Microsoft warned that July 2026 phishing campaigns delivered a digitally signed MSP360 Remote Monitoring and Management installer, version 2.5.0.67, under meeting, PDF, software-update, and government-statement lures. The installer elevates through UAC, registers RMM agent services, opens UDP port 48678, and then installs ConnectWise ScreenConnect as a second remote-access channel. Installers were staged on attacker infrastructure and legitimate clouds including Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase. A related cluster used Faronics Deploy Agent instead of MSP360 before installing ScreenConnect, and the activity remains unattributed.

The Hacker NewsSep 30, 16:32 UTC · 14h agoPhishing & fraud in the wild 7 sources

Hackers Disguise Remote Access Tools as Zoom and PDF Installers to Take Over PCs

Hackers phish employees with fake Zoom and PDF installers that deploy signed MSP360 and ScreenConnect access.

Microsoft observed a July 2026 campaign in which phishing links led to pages imitating Zoom, Adobe, and document portals. Victims who approved a Windows administrator prompt installed a legitimate signed MSP360 RMM agent, version 2.5.0.67, which opened inbound UDP port 48678 and then used PowerShell to silently install ConnectWise ScreenConnect. Follow-on utilities were associated with password theft and browser-data collection. Microsoft has not tied the activity to a named group, and installs stopped when users denied the prompt.

Cyber Security Newsupdated Sep 30, 16:32 UTC · 14h agofirst Sep 30, 14:35 UTC · 16h agoThreat actor in the wild 7 sources3

Phishing Abuses RMM Tools for Persistent Access

Microsoft observed July 2026 phishing campaigns that installed MSP360 RMM and ScreenConnect for persistent access across industries.

In July 2026, Microsoft Defender Experts observed phishing campaigns across multiple industries that delivered a legitimate, digitally signed MSP360 RMM v2.5.0.67 installer through meeting invitations, PDF lures, and fake software-update prompts. After UAC elevation, the installer created persistent MSP360 services and used PowerShell to silently install ConnectWise ScreenConnect as a second remote-access channel. Payloads were hosted on attacker infrastructure and legitimate cloud services including Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase. Actors then collected information and accessed credentials; Microsoft did not observe exploitation of ScreenConnect itself.

Microsoft Security Blogupdated Sep 30, 16:32 UTC · 14h agofirst Sep 29, 21:39 UTC · 1d agoPhishing & fraud in the wild 7 sources

MSP360

Timeline3 articles

Appears with

Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks

Hackers Disguise Remote Access Tools as Zoom and PDF Installers to Take Over PCs

Phishing Abuses RMM Tools for Persistent Access