Hackers Exploit Legitimate RMM Tools MSP360 and ScreenConnect to Steal Windows Credentials

Security researchers have identified a new wave of phishing attacks that leverage widely used remote monitoring and management (RMM) platforms—MSP360 and ScreenConnect—to gain enduring footholds inside Windows environments and harvest user credentials.

The campaigns, first detailed by the independent security outlet GBHackers, employ convincing email lures that direct victims to download what appear to be legitimate software installers. Once executed, the payload installs the RMM client, granting attackers remote control without needing to exploit a software flaw. By operating through trusted utilities, the malicious actors bypass many traditional security checks that focus on vulnerability exploitation.

Unlike classic ransomware or spyware attacks that rely on zero‑day exploits, this approach banks on the inherent trust organizations place in MSP360 and ScreenConnect for legitimate IT administration. After establishing a connection, the intruders can move laterally across the network, capture keystrokes, and exfiltrate stored passwords, effectively turning the management tools into backdoors for credential theft.

Analysts note that the tactic reflects a broader shift in cyber‑crime methodology: leveraging legitimate administrative software to maintain persistence. Because these tools are often whitelisted and run with elevated privileges, they provide a stealthy channel for ongoing surveillance and data collection, complicating detection for endpoint protection solutions that focus on known malware signatures.

The affected RMM products are popular among managed service providers and internal IT teams for tasks such as software deployment, system updates, and remote troubleshooting. Their widespread adoption means that a successful phishing lure can potentially compromise a large number of endpoints across diverse sectors, from small businesses to larger enterprises.

Defenders are urged to reinforce email hygiene, verify the authenticity of any RMM-related download links, and enforce multi‑factor authentication for privileged accounts. Additionally, organizations should monitor for unusual RMM client activity, such as connections from unexpected IP addresses or execution of commands outside normal maintenance windows.

While no public disclosures of data breaches tied directly to these specific campaigns have emerged yet, the ability to harvest credentials poses a significant risk. Stolen login information can be repurposed for further attacks, including ransomware deployment or lateral movement into more sensitive systems.

Security firms anticipate that the use of legitimate tools for malicious purposes will continue to rise, prompting a reassessment of how trust is assigned to software that is traditionally considered safe. Ongoing vigilance, combined with robust verification processes for remote management utilities, will be essential to mitigate this evolving threat vector.