Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks

Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks Ravie LakshmananSep 30, 2026Endpoint Security / Social Engineering Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content. "Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected devices and enabled threat actors to gain an initial foothold using trusted administrative software," the Microsoft Security Research team said. The initial foothold is then used to download and install a ConnectWise ScreenConnect client, offering threat actors a redundant remote-access channel to compromised endpoints. The access is then abused to deliver…