Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks
Phishing campaigns abuse signed MSP360 installers to deploy ScreenConnect and establish dual remote-access footholds.
Microsoft warned that July 2026 phishing campaigns delivered a digitally signed MSP360 Remote Monitoring and Management installer, version 2.5.0.67, under meeting, PDF, software-update, and government-statement lures. The installer elevates through UAC, registers RMM agent services, opens UDP port 48678, and then installs ConnectWise ScreenConnect as a second remote-access channel. Installers were staged on attacker infrastructure and legitimate clouds including Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase. A related cluster used Faronics Deploy Agent instead of MSP360 before installing ScreenConnect, and the activity remains unattributed.
- Signed MSP360 2.5.0.67 installers arrived through phishing lures posing as invitations and updates.
- Installers elevate via UAC, register agent services, and allow UDP port 48678.
- ScreenConnect is then installed as a second remote-access channel.
- A related cluster used Faronics Deploy Agent before installing ScreenConnect.
- Microsoft has not attributed the July 2026 activity to a known group.
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 2.5.0.67 | r deceptive names such as below - VIP_ECARD_INVITATION_rmm_v2.5.0.67_oid[redacted].exe ZoomSetup_Installation_v2.5.0.67_ oid[red |
Full article464 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 30, 2026Endpoint Security / Social Engineering
Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content.
"Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected devices and enabled threat actors to gain an initial foothold using trusted administrative software," the Microsoft Security Research team said.
The initial foothold is then used to download and install a ConnectWise ScreenConnect client, offering threat actors a redundant remote-access channel to compromised endpoints. The access is then abused to deliver additional tools and carry out information collection and credential-access operations. The activity has not been attributed to any known threat actor or group.
The multi-stage intrusion chain, which the Windows maker detected in July 2026, begins with phishing emails distributing a digitally signed MSP360 RMM v2.5.0.67 installer under deceptive names such as below -
- VIP_ECARD_INVITATION_rmm_v2.5.0.67_oid[redacted].exe
- ZoomSetup_Installation_v2.5.0.67_ oid[redacted].exe
- PDF Reader & Editor the Adobe Acrobatte_rmm_v2.5.0.67_ oid[redacted].exe
- RSVP_INVITATION_E_CARD_rmm_v2.5.0.67_ oid[redacted].exe
- SSA.GOV_STATEMENT_rmm_v2.5.0.67_ oid[redacted].exe
The installer packages are staged on attacker-controlled infrastructure and legitimate cloud services including Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase.
Once launched, the installer drops multiple DLLs, while relaunching itself by invoking the Windows User Account Control (UAC) elevation workflow to run in a privileged context, establish persistent access by deploying MSP360, and leverage the RMM tool to execute PowerShell for stealthily installing ScreenConnect.
The installer also enumerates installed .NET runtimes and registers two Windows services (RMM.Agent.exe and RMM.Agent.Launcher.exe) and creates Registry-based autorun entries to ensure that MSP360 is automatically launched when users sign-in to the machine.
Furthermore, it modifies the Windows Firewall configuration to allow inbound UDP traffic to MSP360 (i.e., RMM.Agent.exe) on port 48678.
The dual-RMM remote access attack enables the attacker to transfer additional executables and facilitate post-compromise activity, while camouflaging malicious activity within regular remote administration workflows. The payloads are run through ScreenConnect's native RunFile functionality.
Microsoft said it also observed a separate set of attacks in July 2026 that switched MSP360 for Faronics Deploy Agent to find a way in, and then used it to download and install ScreenConnect. This suggests that the threat actors are putting multiple RMM tools for remote access.
"This activity highlights how threat actors continue to abuse legitimate remote administration software to blend into normal IT operations while maintaining persistent access and reducing detection opportunities," Microsoft said.
"The combination of MSP360 and ScreenConnect provided the threat actor with redundant remote administration channels and enabled the transfer, execution, and management of additional tooling during subsequent stages of the intrusion."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.