Attackers Abuse MSP360 to Deploy ScreenConnect in Dual RMM Phishing Attacks

Attackers abuse MSP360 by distributing its genuine installer through phishing lures, turning trusted remote management software into the attack itself.

Microsoft has warned that phishing campaigns are delivering a real MSP360 installer under fake identities, which means the IT tooling your business relies on can become the entry point.

Microsoft has issued a warning about an active phishing campaign distributing an installer for MSP360, a widely used Remote Monitoring and Management platform, while disguising it as something entirely routine. The lures include fake meeting invitations, PDF themed attachments, and prompts telling users their software needs an update. Combining familiar social engineering formats with a real, signed installer makes the attack harder to catch than most.

Once a target runs the file, the legitimate MSP360 installer executes and establishes remote management access on the affected machine. Because the software itself is not malicious, many endpoint security tools will not raise an alarm. The attacker now has a foothold that looks, to most monitoring systems, like normal managed IT activity.

The campaign does not stop at MSP360. According to the Microsoft warning reported by The Hacker News, attackers also deploy ScreenConnect, a separate remote access tool, on the same compromised endpoints. Running two independent RMM agents on one machine is what security researchers describe as a dual RMM approach. If the victim’s IT team discovers and removes one tool, the attacker retains full access through the other.

This dual tool strategy reflects a broader shift in how threat actors operate. Rather than relying on custom malware that security vendors can fingerprint and block, they abuse software that businesses already trust. The approach is sometimes called living off the land, and it is increasingly common in campaigns targeting small and mid sized businesses.

For an SMB owner or IT manager, the practical implication is uncomfortable. The tools your managed service provider legitimately uses to support your environment are the same tools an attacker can abuse to control it. That does not mean RMM software is unsafe. It means that how it is deployed, monitored, and authorized matters far more than most organizations currently treat it.

The phishing lures identified in this campaign are not exotic. Meeting invitations arrive in inboxes every day. PDF attachments are routine in most business workflows. Software update prompts feel urgent by design. Attackers choose these formats precisely because they generate clicks without triggering suspicion. An employee who would never open an unexpected executable may still click a calendar invite or a document link without a second thought.

Controlling which RMM agents are authorized to run in your environment is one of the most practical steps an IT manager can take right now. If your MSP uses a specific platform, that platform and only that platform should appear on your managed endpoints. Any secondary remote access tool that appears without a documented change request deserves immediate investigation, regardless of whether it carries a known brand name.

Application control policies can support that posture. Maintaining an approved software list and alerting on any new remote access tool installation gives your team a detection layer that does not depend on the installer being flagged as malicious. The MSP360 installer in this campaign is legitimate. The alert you need is not ‘this file is dangerous’ but rather ‘this software was not approved.’

Employee training remains a non negotiable control. The phishing techniques described in this campaign, fake meeting invites, PDF lures, and update prompts, are defeated most reliably when staff know what to look for and have a clear, low friction way to report something that feels off. A reporting culture matters as much as a reporting button.

SMBs working with managed service providers should also have a direct conversation with their MSP about this threat. Ask which RMM platforms they use, how they authenticate into your environment, and what controls exist to prevent unauthorized use of those same tools. A reputable MSP will welcome that conversation. Vague answers are themselves a signal worth paying attention to.

Network monitoring can surface anomalies even when endpoint tools miss them. RMM software communicates with cloud hosted relay infrastructure on a predictable schedule. Unusual outbound connections to new remote management domains, especially those appearing shortly after a phishing email lands, can be a meaningful detection signal for teams with network visibility.

Attackers choose targets partly based on which defenses are absent. SMBs that lack centralized log review, endpoint detection and response tooling, or a formal incident response plan are more attractive targets than organizations that have invested in those basics. This campaign is a direct reminder that the investment gap has real consequences.

Responding to a dual RMM compromise without a plan is chaotic. Both tools must be removed, credentials that may have been exposed must be rotated, and the initial phishing entry point must be identified and closed. Organizations that have rehearsed that process, even informally, recover faster and with less business disruption than those improvising under pressure.

Nothing about this attack requires a zero day exploit or nation state resources. It is a disciplined use of publicly available software, delivered through familiar phishing formats, exploiting the trust that legitimate tools carry. Defending against it requires the same discipline: clear policies, monitored environments, trained staff, and a partner who can see what your own team cannot.

TeckPath Perspective: When attackers abuse MSP360 and pair it with a second RMM tool, they are betting that your environment has no policy defining which remote access software is authorized, and closing that gap is one of the highest value actions a small business can take right now.

The most dangerous file on your network today is not a piece of malware. It is a legitimate tool running somewhere it was never supposed to be.