Huntress reports attackers are increasingly installing legitimate remote monitoring and management (RMM) tools after a phishing click, giving them persistent remote control that can blend in with normal IT activity. The article also describes common identity-focused schemes like hidden mailbox rules for invoice fraud and adversary-in-the-middle token theft that bypasses MFA prompts. It includes several practical lures, fake service agreements, device-code login prompts, and fake downloads, that can be used for security awareness simulations.
According to Huntress, legitimate remote monitoring and management (RMM) software was involved in 45% of endpoint-related incidents the firm recorded in Q1 2026. The entry point is often mundane: a phishing email disguised as a service agreement asks the recipient to review or sign a document. One click installs an RMM tool, and in one documented case, a single click led to an attacker installing Tiflux and then stacking UltraVNC, Splashtop, and ScreenConnect on the same device, giving multiple paths back into the environment from one initial compromise.
The same reporting describes two other identity-focused schemes. In mailbox manipulation, an attacker already inside an inbox creates a hidden rule that routes a vendor's replies to a folder like Archive, then swaps in an altered invoice that redirects payment. Separately, adversary-in-the-middle attacks intercept Microsoft 365 session tokens, letting an attacker remain signed in without a password or an MFA prompt. Device code phishing works similarly: a fake workflow prompt sends a victim to Microsoft's real device code login, and once the code is entered, the attacker holds an access token that can survive a password reset.
Each of these techniques exploits trust in something that looks ordinary. RMM tools are the same software IT teams use every day, so remote command execution through them looks like normal administrator work. Mailbox rules are an everyday productivity feature, so a rule quietly diverting vendor replies rarely draws attention. Device code logins are a real Microsoft sign-in mechanism, so victims are completing a legitimate-looking workflow, not an obviously fake login page.
These patterns show that high-impact access often starts with an ordinary-looking click, not an obviously malicious one.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A phishing email disguised as a service agreement prompts a click that installs a legitimate RMM tool like Tiflux, after which attackers can stack additional tools such as UltraVNC, Splashtop, and ScreenConnect on the same device for persistent access.
Because RMM tools are the same software IT teams use for legitimate remote management, an attacker's activity through them can look like ordinary administrator work rather than an intrusion.
A fake workflow prompt directs a victim to Microsoft's real device code login page, and once they enter the attacker-supplied code, the attacker receives an access token that can survive a password reset without triggering an MFA prompt.
An attacker already inside an inbox creates a hidden rule routing a vendor's replies to a folder like Archive, then swaps in an altered invoice to redirect payment while the real vendor's messages go unnoticed.
You get an email: “Service Agreement – Please Review and Confirm.” Looks routine, right? But one click on that “agreement” can silently install real IT tools like Tiflux, UltraVNC, Splashtop, even ScreenConnect, giving someone remote control that looks like normal admin work. Huntress saw this in 45% of endpoint incidents: one phishing click, several RMM tools, and a backdoor that blends in with real IT. If you didn’t ask for it, that “agreement” is not harmless paperwork. Your move: if you get an unexpected agreement or shared doc, don’t open it, report it to IT or Security so they can check before anyone clicks.
Cisco Talos Incident Response reports that phishing drove initial access in over half of Q2 2026 cases, often using QR codes in PDF attachments and trusted cloud hosting to evade email defenses. Attackers frequently bypassed multi-factor authentication using adversary-in-the-middle proxies,…
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
The article describes how real-world phishing and social engineering are evolving to bypass the checks employees are trained to use (bad grammar, suspicious URLs, obvious fake login pages). It highlights specific, observed attack workflows including QR-code “device hop” phishing, OAuth token theft…
Attackers are impersonating Bank of America in mass phishing emails to pressure people into clicking a link “to avoid account restrictions.” Mac users are led to a fake login page that steals credentials and personal/financial data, while Windows users are tricked into installing a ScreenConnect…
Attackers trick employees into entering a short “device code” on a real Microsoft sign-in page (microsoft.com/devicelogin), causing Microsoft 365 to issue login tokens directly to the attacker. Because the victim completes a legitimate MFA-approved sign-in on a legitimate Microsoft URL, the…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service platform Microsoft links to over 12,000 compromised inboxes across more than 10,000 organizations. The service used deceptive emails to trick people into pasting a “device code” into Microsoft’s real sign-in page…
