Malicious calendar invites surge, stealing Microsoft logins and pushing ScreenConnect
Check Point counted more than 740,000 such emails in the first two weeks of October, up from a few thousand a month in April.
1
Stories per day · 30 days
5 RSS
Relatedrmm2ai-cybercrime1calendar-phishing1clickfix1credential-harvesting1huntress1ics1microsoft1opinion1phishing1ransomware1
35 stories, newest first · one card per story
Stories tagged #screenconnect
What Cybersecurity Leaders Must Prioritize in 2027
Huntress urges leaders to prioritize RMM abuse, AI-enabled crime, social-engineering loaders, and multi-extortion ransomware.
Microsoft Power BI Phishing Campaign Deploys Rogue ScreenConnect RMMs for Persistent Access
Huntress found a Power BI phishing campaign that installs rogue ScreenConnect clients for persistent Windows access.
Attackers Use Power BI Phishing to Install Multiple RMMs and Maintain Persistent Access
Phishers abused Microsoft Power BI dashboards to push rogue ScreenConnect RMM clients, creating redundant persistent remote access on 20-plus endpoints.
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
Huntress reports phishing that abuses Microsoft Power BI links to install rogue ScreenConnect RMM clients.
Hackers Abuse Legitimate ScreenConnect Tool to Gain Remote Access Through Phishing
Phishers sent a fake payment notice that installed a legitimate ScreenConnect client aimed at their server.
5
Attackers Abuse Legitimate ScreenConnect Client in Phishing Campaign to Gain Remote Access
Phishers deliver a legitimately signed ConnectWise ScreenConnect client preconfigured to call back to attacker infrastructure, bypassing malware detection for remote access.
5
ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st)
Attackers phish victims into running a signed ScreenConnect client that calls an attacker instance.
2
Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks
Phishing campaigns abuse signed MSP360 installers to deploy ScreenConnect and establish dual remote-access footholds.
Hackers Disguise Remote Access Tools as Zoom and PDF Installers to Take Over PCs
Hackers phish employees with fake Zoom and PDF installers that deploy signed MSP360 and ScreenConnect access.
US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access
US-focused CSuite phishing steals Microsoft 365 sessions and installs RMM tools for persistent access.
Hackers Abuse MSP360 and ScreenConnect RMM Tools for Persistent Access and Credential Theft
Microsoft details a phishing campaign abusing signed MSP360 RMM installers to deploy ScreenConnect for persistent access and browser credential theft.
Phishing Abuses RMM Tools for Persistent Access
Microsoft observed July 2026 phishing campaigns that installed MSP360 RMM and ScreenConnect for persistent access across industries.
AgtaBackup RAT Uses Fake Microsoft Store Pages and RMM Tools to Hijack Windows Systems
AgtaBackup RAT uses fake Microsoft Store pages and legitimate RMM tools to steal data from Windows systems.
11
Attackers Hid Behind Trusted RMM Software Before Deploying a Full Surveillance RAT
Attackers abuse signed RMM tools via fake Microsoft Store pages to deploy new .NET spyware RAT AgtaBackup with keylogging and browser data theft.
2
Crooks use fake desktop apps to fool HR staff into giving them remote access
Attackers impersonate US HR and payroll vendors with fake desktop apps that silently install ConnectWise ScreenConnect.
5
Fake payroll desktop apps hand attackers a route to company paychecks
Fake payroll desktop apps silently install ScreenConnect, giving one operator a path to company paychecks.
1
Rogue RMM Abuse: How Attackers Exploit Remote Access Tools
Huntress details phishing campaigns installing rogue ITarian and ScreenConnect RMM clients with SYSTEM persistence, amid a 277% spike in RMM abuse.
1
CISA Warns of Critical ScreenConnect Vulnerability Actively Exploited in Attacks
CISA added actively exploited ConnectWise ScreenConnect flaw CVE-2026-84869 to the KEV catalog, setting a September 14 patch deadline.
7
Critical ScreenConnect flaw now actively exploited in attacks
CISA confirms active exploitation of critical ConnectWise ScreenConnect flaw CVE-2026-84869, ordering federal agencies to mitigate within three days.
3
U.S. CISA adds GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities catalog
CISA added four actively exploited GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to the KEV catalog with imminent deadlines.
9
ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks
ConnectWise patched critical ScreenConnect flaw CVE-2026-84869 (CVSS 9.9) exploited since August 20 in worm-like attacks; CISA added it to KEV.
4
Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited
Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.
4
CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
CISA added five actively exploited JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS flaws to its KEV catalog.
5