Cybercriminals Exploit MSP360 RMM Tool in Sophisticated Phishing Scheme

Microsoft has issued an alert about a wave of phishing attacks that distribute a malicious installer masquerading as the MSP360 Remote Monitoring and Management (RMM) platform. The campaign leverages seemingly innocuous email lures—such as fabricated meeting invitations, PDF‑styled messages and faux software update notifications—to convince recipients to download and run the payload.

Once the installer is executed, it drops the ScreenConnect remote‑access component onto the victim’s machine, granting attackers persistent control. The dual‑use of MSP360 and ScreenConnect allows threat actors to blend legitimate‑looking administrative tools with covert back‑door capabilities, making detection more difficult for standard endpoint defenses.

Security researchers note that the attackers tailor their social‑engineering content to the target’s environment, often referencing specific departments or ongoing projects to increase credibility. By embedding the malicious file within a familiar context, the lures achieve higher click‑through rates than generic spam, a tactic that has become increasingly common in ransomware‑related operations.

Microsoft’s advisory highlights the importance of verifying the source of any software download, especially when the request arrives via email. Organizations are urged to enforce multi‑factor authentication for privileged accounts, maintain up‑to‑date patches for both MSP360 and ScreenConnect, and employ behavioral analytics that can flag unusual remote‑session activity. Endpoint detection and response (EDR) solutions that can identify the characteristic signatures of the ScreenConnect payload are also recommended.

The incident underscores a broader trend where cybercriminals co‑opt legitimate IT management utilities to bypass traditional security controls. As threat actors continue to refine their phishing playbooks, experts anticipate further campaigns that blend multiple remote‑access tools, compelling defenders to adopt more layered verification processes and continuous monitoring to mitigate the risk of unauthorized system access.