On September 29, 2026, Microsoft published research on phishing campaigns that trick people into installing legitimate, digitally signed remote-management software - which then silently installs a second remote-access tool on their computer. It matters for small businesses because the lures are everyday office bait, and the one moment that stops the attack is a Windows prompt your own staff control.
Quick answer: According to Microsoft’s security research team, phishing emails posing as meeting invitations, PDF updates, and package-delivery notices delivered a real, signed MSP360 remote-management installer under fake filenames. Once a user approved the Windows elevation prompt, it silently installed ConnectWise ScreenConnect for persistent remote access. The single most important action: teach your team that an unexpected “do you want to allow this app to make changes?” prompt means stop and ask - Microsoft observed the attack fail whenever that prompt was denied.
What happened?
Microsoft’s Defender Experts observed the campaigns in July 2026 and published their full analysis on September 29, 2026, in a post titled “Phishing Abuses RMM Tools for Persistent Access.” The Hacker News covered the disclosure the same week.
The attack works in stages, and the details are worth understanding because each stage is designed to look normal:
-
The lure. Phishing emails used themes Microsoft describes as workplace meeting requests, Zoom and Google Meet installation prompts, Adobe Acrobat and PDF reader updates, RSVP invitations and e-cards, job offer documents, document review and signature requests, and DHL package-delivery content. Clicking led to fake landing pages impersonating document-sharing portals, Adobe Reader download pages, Zoom installation pages, and business collaboration platforms - with downloads hosted on a mix of attacker-controlled sites and legitimate cloud services including Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase.
-
The signed installer. The downloaded files had names like
VIP_ECARD_INVITATIONorZoomSetup_Installation, but Microsoft’s analysis found many contained the same thing: a genuine, digitally signed MSP360 RMM (remote monitoring and management) installer, version 2.5.0.67. Because it’s real vendor software with a valid signature, it doesn’t trip antivirus the way a custom malware file would. -
The elevation prompt. When run, the installer asked Windows for elevated privileges through the standard User Account Control dialog. This is the hinge of the whole attack - and Microsoft explicitly observed that when the elevation was denied or aborted, the installation terminated before any remote-access software was deployed.
-
The silent second channel. With privileges granted, the installer registered Windows services (Microsoft observed
RMM.Agent.exeandRMM.Agent.Launcher.exe), added a firewall rule, and then launched PowerShell to download and silently install a ConnectWise ScreenConnect client - giving the attacker a second, independent remote-access channel. From there, Microsoft observed the attacker transferring additional utilities with names mimicking Windows components -WindowsUpdate.exe,DefenderControl.exe,WebBrowserPassView.exe- associated with credential access, information collection, and reducing defender visibility.
Microsoft also observed a separate July activity set using Faronics Deploy Agent the same way, and the company did not attribute the campaigns to a named threat actor. Notably, Microsoft stated it did not observe exploitation of ScreenConnect software itself - the abuse is of legitimately obtained remote-administration tools, which is exactly what makes the technique blend into normal IT operations.
Why does this matter for small businesses?
For Pennsylvania small businesses and nonprofits, three things about this campaign stand out.
The bait is ordinary office traffic. Meeting invitations, PDF updates, package notifications, job offers - these are the emails a 10-person office receives every single day. Nothing about the lure requires an enterprise target; if anything, organizations without a security team clicking through email are the easier mark.
“Signed” doesn’t mean “safe.” Most people have absorbed the advice to check whether software is legitimate before running it. This attack weaponizes that instinct: the installer is genuine, digitally signed vendor software. The defense isn’t a better antivirus signature - it’s controlling what software is allowed to run in the first place, and paying attention when something asks for administrator rights.
Your staff are the control point - in a good way. The most useful detail in Microsoft’s write-up for a small organization is that the attack fails at the elevation prompt. A person who wasn’t trying to install anything, clicking “No” on a UAC dialog, stopped the intrusion cold. That’s a rare piece of good news in security reporting: a free, no-software control that any organization can deploy this week with a five-minute conversation.
What should you do this week?
-
Brief your team on the elevation prompt (highest value, lowest cost). The rule: if a file you just opened or downloaded asks “do you want to allow this app to make changes to your device?” and you weren’t deliberately installing software, click No and check with someone. Microsoft observed the attack fail when elevation was denied.
-
Check your computers for remote-access software nobody installed. Look through installed programs and running services for anything you or your IT provider didn’t set up - especially anything named “RMM Agent” or “ScreenConnect.” Microsoft also observed attacker files staged under
ScreenConnect\Tempin the Documents and OneDrive Documents folders. If you find something, don’t just uninstall it - treat it as a possible intrusion, disconnect the machine, and get help, because password-stealing tools may have already run. -
Inventory your legitimate remote-access tools. If you use an RMM or remote-support tool (many managed IT relationships do, including ours), make sure you know what’s installed and that multi-factor authentication is enforced on it - Microsoft’s mitigation guidance specifically calls for MFA on approved RMM systems. If you don’t use one, that’s worth knowing too, because anything remote-access-shaped on your network is then automatically suspicious.
-
Restrict what ordinary users can install. Microsoft’s guidance includes using application control (such as AppLocker or Application Control for Windows) to block unapproved IT management tools, including by publisher certificate. For a small business, the practical version of this is simpler: don’t give day-to-day accounts local administrator rights. A user without admin rights can’t approve the elevation prompt that this attack depends on.
-
Make sure cloud-delivered protection is on. Microsoft recommends enabling cloud-delivered protection in Defender Antivirus (or your product’s equivalent) so rapidly evolving attacker tooling gets flagged even when the initial file looks legitimate.
Frequently asked questions
What is an RMM tool, and why are attackers using it? RMM stands for remote monitoring and management - software IT providers use to connect to computers remotely for support and updates. Attackers like it because it’s legitimate, digitally signed software that antivirus won’t flag, and once installed it lets them control the machine as if they were the IT department. Microsoft’s September 29, 2026 advisory describes phishing campaigns installing a signed MSP360 RMM installer, which then silently downloaded ConnectWise ScreenConnect as a second remote-access channel.
Our antivirus didn’t flag anything. Are we safe? Not necessarily. The MSP360 installer Microsoft described is real, digitally signed vendor software, so it doesn’t look like malware to antivirus. That’s the whole point of this technique. The better check is behavioral: look for remote-access software on your computers that you or your IT provider didn’t install - anything named RMM Agent, ScreenConnect, or similar - and treat any find as a possible intrusion, not just clutter.
How do we know if one of our computers was affected? Check installed programs and services for anything you don’t recognize, especially “RMM Agent” (the service name Microsoft observed) or “ScreenConnect.” Microsoft also observed attacker files staged in Documents and OneDrive Documents folders under a “ScreenConnect\Temp” path, with names mimicking Windows components like WindowsUpdate.exe or DefenderControl.exe. If you find any of this, disconnect the machine from the network and get help before assuming it’s clean.
Does multi-factor authentication help against this? MFA on your Microsoft 365 and other accounts is still one of the highest-value protections you can have, and Microsoft’s guidance for this threat includes enforcing MFA on approved remote-management systems. But this particular attack bypasses account login entirely - the attacker’s access comes from software running on the computer itself. MFA limits what a stolen password is worth; it doesn’t stop a remote-control tool someone was tricked into installing.
What is the single most important thing to do this week? Brief your team on the User Account Control prompt. Microsoft’s analysis shows that when people denied the elevation prompt, the installation failed and no remote-access software was deployed. So the rule for your staff is simple: if a file they just opened or downloaded asks for permission to make changes to the computer, and they weren’t intentionally installing something, click “No” and ask someone before proceeding.
Where Merit IT fits in
Attacks like this don’t break in through some exotic flaw - they walk in through a signed installer and a clicked “Yes.” Stopping them is unglamorous, ongoing work: knowing exactly what software is on your computers, controlling who can install more, watching for the remote-access tools that shouldn’t be there, and keeping your team sharp on the prompts that matter. That’s the heart of our IT support practice - patching, monitoring, and endpoint management that keeps the lights on and the doors shut. And if you’d rather your team never face these prompts without a net, our software development team builds internal tools and automations that reduce the manual steps where mistakes happen.
We work with small businesses and nonprofits across Pennsylvania, month-to-month - no long-term contract. We earn your business every single month, or we don’t.
Get a free technology assessment - we’ll review what’s installed on your systems, your patching status, and your overall security posture, and give you a clear picture of where you stand. No obligation, no pressure. Or keep reading on the Merit IT blog for more practical, no-hype IT guidance.