Attackers Abuse MSP360 to Deploy Screen Connect in Dual-RMM Phishing Attacks
Summary: Microsoft reported phishing campaigns that deliver a digitally signed MSP360 RMM v2.5.0.67 installer disguised as meeting invitations, PDF-themed lures, and software update prompts, with the installer staged on attacker infrastructure and services including Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase. Once run, the installer elevates via UAC, registers the RMM.Agent.exe and RMM.Agent.Launcher.exe services with Registry autorun entries, opens inbound UDP port 48678, and uses MSP360 to run PowerShell that installs a ConnectWise ScreenConnect client as a second remote-access channel.
Key Takeaway: The chain gives an intruder two legitimate RMM channels, so activity blends into normal IT administration and survives the loss of one tool; Microsoft also saw a July 2026 set of attacks swap MSP360 for the Faronics Deploy Agent and still land ScreenConnect, and the activity has not been attributed to any known group.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026