Microsoft observed real phishing campaigns that tricked employees into downloading a legitimate MSP360 remote-management installer disguised as meeting invites, PDFs, and software updates. After the victim ran it (and approved an admin prompt), attackers gained persistent remote access and then installed ConnectWise ScreenConnect as a backup remote-control channel for follow-on theft and data collection.
Microsoft observed phishing campaigns that delivered a legitimate, digitally signed MSP360 remote monitoring and management (RMM) installer under deceptive filenames designed to look like meeting invitations, PDF documents, or software update prompts. Victims were directed to actor-controlled landing pages that impersonated document-sharing portals, Adobe Reader download pages, Zoom installation pages, and business collaboration platforms. Other lures used DHL and package-delivery themes, or government statement themes, redirecting victims to download locations hosted on both attacker infrastructure and legitimate cloud services including Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase.
Once a victim ran the installer and approved a Windows User Account Control (UAC) prompt, MSP360 services were established for persistent remote administration access. Attackers then used that access to download and silently install ConnectWise ScreenConnect, creating a redundant remote access channel. Post-compromise activity included credential-access operations and information collection, with additional executables staged under Windows or security-sounding names to avoid drawing attention.
The campaign relied on legitimate, signed software rather than custom malware, which helped it blend into normal IT activity. Filenames were crafted to resemble everyday business content such as invitations, PDFs, and installers, exploiting the routine trust employees place in documents and update prompts. Rotating delivery infrastructure, including reputable cloud storage providers, let the actor keep distributing the same MSP360 installer under different lure themes without relying on a single suspicious domain.
Organizations can reduce exposure to this pattern of attack by combining user training with technical controls:
This incident illustrates that threat actors continue to abuse legitimate remote administration software to blend into normal IT operations while maintaining persistent access, without needing to exploit a software vulnerability.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers used a legitimate, digitally signed MSP360 RMM installer renamed to look like meeting invitations, PDFs, or software updates, so the file itself passed as trusted software rather than obvious malware.
Once executed and approved via a Windows UAC prompt, MSP360 established persistent remote access, which attackers then used to silently install ConnectWise ScreenConnect as a backup remote control channel.
No. Microsoft found no software vulnerability was exploited; the incident involved abuse of legitimate remote administration tools rather than an exploit.
Train staff that meeting invites, PDFs, and shipping notices should never require running an .exe, treat unexpected UAC prompts as a reason to contact IT, and use application control policies to block unapproved remote management tools.
You get a Zoom invite email, click the link, and it says: “Download ZoomSetup_Installation_v2.5.0.67.exe” to join. Here’s the trick: that file is a real MSP360 remote-management installer, renamed to look like a Zoom setup, PDF reader, even VIP_ECARD_INVITATION_rmm_v2.5.0.67.exe. You run it, click Yes on the Windows admin prompt, and now they have MSP360 on your machine. From there they quietly drop ConnectWise ScreenConnect, then start grabbing credentials and data like a legit IT tool. Aha moment: real invites, PDFs, and shipping notices never need an .exe. If a ‘document’ download triggers a Windows admin prompt, stop and call IT, do not click Yes.
Researchers observed a real phishing campaign that abused Microsoft 365’s Direct Send feature to make emails look like they came from the victim organization’s own domain, without compromising an employee account. The campaign was timed to mimic human sending patterns during U.S. Eastern business…
The article highlights real, ongoing campaigns where attackers trick people into installing malware via fake software-download websites and a disguised browser extension. These lures are used to steal credentials, browser cookies, and authenticated sessions, letting attackers take over accounts…
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
The bulletin describes an APT36 (Transparent Tribe) espionage campaign that uses social-engineering lures and spoofed download portals to trick targets into installing a malicious Windows installer. The installer (“TMS_AfghanTelecom.exe”) deploys the PATCHCORD backdoor, which then calls out to…
