Hackers are using fake Zoom installers, PDF reader updates, and meeting invitations to trick Windows users into installing legitimate remote management software.
Microsoft Defender Experts observed these phishing campaigns in July 2026, targeting organizations across multiple industries.
The attacks delivered MSP360 Remote Monitoring and Management (RMM) version 2.5.0.67 under misleading filenames. Although the installer was digitally signed and legitimate, attackers used it to gain unauthorized access to victim devices.
After establishing access, the attackers installed ConnectWise ScreenConnect to create a second remote administration channel.
Microsoft did not observe attackers exploiting a ScreenConnect vulnerability. Instead, they abused legitimate software to maintain access and carry out further operations.
Fake Installers Deploy RATs
The phishing emails directed victims to websites impersonating document portals, Adobe Reader download pages, Zoom installation pages, and business collaboration services. Other lures included job offers, delivery notices, invitations, and document signature requests.
Payloads were hosted on attacker infrastructure, compromised websites, and legitimate services, including Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase. Different filenames often concealed the same MSP360 installer.
Once a victim opened the executable, the installer requested administrator privileges through Windows User Account Control. Successful elevation allowed it to install components under C:\Program Files\RMM Agent\.
The installation registered services for RMM.Agent.exe and RMM.Agent.Launcher.exe, providing persistent remote management access.
It also created registry autorun entries for tray applications and an inbound Windows Firewall rule allowing UDP traffic on port 48678.
The installer checked installed .NET runtimes using dotnet --list-runtimes and recorded installation messages through eventcreate.exe.
Some installation attempts failed when users denied or abandoned the elevation request. In those cases, Microsoft found no evidence of the completed services or remote management functionality seen in successful deployments.
After installation, RMM.Agent.exe launched PowerShell, changed the execution policy for the current session, and downloaded ClientSetup.msi using Invoke-WebRequest. It then installed the package silently through msiexec.exe with the /qn switch.
This deployed ScreenConnect services and client components, establishing another access route independent of MSP360.
Attackers used ScreenConnect’s RunFile feature to transfer and execute additional programs from temporary folders within users’ Documents directories, including OneDrive locations.
Observed filenames included WindowsSecurity_Password.exe, DefenderControl.exe, WebBrowserPassView.exe, and WebBrowserBookmarksView.exe.
Several names imitated Windows, Microsoft Defender, and security components. Microsoft linked the follow-on activity to credential access, information collection, additional tool execution, and efforts to reduce defender visibility.
Microsoft also observed separate July activity using FaronicsDeployAgent.exe to install ScreenConnect. The campaigns remain unattributed.
Organizations should restrict unapproved remote management tools through Application Control for Windows or AppLocker and enforce multifactor authentication on approved platforms.
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc | Masqueraded MSP360 RMM v2.5.0.67 installer |
| SHA1 | f34330d4c6e0aa978dc3af40360c14b31ad51127 | Same MSP360 instal |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
