Microsoft Defender Experts observed a phishing campaign in July 2026 that does not drop obvious malware. It installs real, digitally signed remote-management software, then uses that to install a second remote-access tool. Microsoft published its findings on September 29, 2026. The targets were organizations across multiple industries, so any business with Windows PCs and staff who click download links in email is in scope.
The practical problem is that antivirus and staff instinct both look for something that seems malicious. These tools are legitimate products that IT teams use every day, which is exactly why attackers like them.
What Microsoft observed
Microsoft lists the lure themes the attacker used. They included meeting requests, Zoom and Google Meet installers, Adobe Acrobat and PDF updates, RSVP invitations and e-cards, job offers, document signature requests, and DHL-style package deliveries. The downloads were hosted on attacker-controlled domains, compromised websites, and cloud services including Amazon S3, Cloudflare R2, Dropbox, GitLab and Supabase.
Microsoft reports that many differently named files were the same installer: a signed MSP360 RMM version 2.5.0.67 package, renamed to look like a document or a Zoom setup file. Microsoft notes the signing certificate has since been revoked.
Once someone ran the file and approved the Windows elevation prompt, the sequence was:
- The remote-management agent installed itself as two Windows services (RMM.Agent.exe and RMM.Agent.Launcher.exe), added registry entries so its tray components start at sign-in, and added an inbound firewall rule allowing UDP traffic to the agent.
- The agent then launched PowerShell, which downloaded a second installer and ran it silently.
- That second installer was the ConnectWise ScreenConnect client, which gave the attacker a second, independent way back in.
- Through ScreenConnect, the attacker transferred and ran further tools, among them WebBrowserPassView and DefenderControl.exe. Microsoft says several of the observed tools are commonly associated with credential access, information collection and reduced defender visibility.
The activity is not attributed to a named group.
Why this matters for a small business
Two separate remote-access channels mean that removing one tool does not end the intrusion. Microsoft says several of the follow-on tools are commonly associated with credential access and information collection. And because the first installer was signed, a quick glance at the file properties would not raise any alarm.
Microsoft also noted that the installer requested Windows (UAC) elevation. If the person approved the prompt, the services and startup entries were created. If the prompt was denied or closed, the installation stopped before any services or persistence were put in place. That makes the prompt, and who is allowed to approve it, a real control. Where staff do not have local administrator rights, an approval has to come from someone who can recognize the request as out of place.
The attackers were not tied to a single tool. In similar July activity, Microsoft observed FaronicsDeployAgent.exe used as the initial remote management tool to install ScreenConnect. The point for a business is that blocking one product name does not close the door. The approved-list approach in the checklist below works because it does not depend on knowing which tool the attacker picks next.
It is also worth knowing why a signature is not enough. A digital signature tells you who published a file and that it was not altered. It does not tell you whether your business wanted that software on that PC. Application control rules that name the publishers you approve answer the question that matters, which is whether this tool belongs here.
What to do: a checklist
- List the remote-access tools you actually use. Write down every remote-management and remote-support product your business and your vendors rely on. Anything not on that list is suspect.
- Turn on MFA for the ones you approve. Microsoft advises enforcing multifactor authentication on approved remote-management platforms that support it.
- Block the rest. Microsoft recommends using Application Control for Windows with certificate-based rules, or AppLocker publisher rules, to block unapproved remote-management software. Defender for Endpoint can also block specific signed applications by certificate.
- Search for installs you did not approve. Check PCs for remote-management agents and ScreenConnect clients nobody can explain. Microsoft suggests that if you find an unapproved one, you reset the passwords of the accounts used to install it, and investigate further if a system-level account was involved.
- Turn on cloud-delivered protection in Microsoft Defender Antivirus. The ransomware rule below depends on it.
- Enable two attack surface reduction rules. Microsoft recommends “Use advanced protection against ransomware” and “Block process creations originating from PsExec and WMI commands.” Microsoft’s blog notes that some organizations may see compatibility issues with the PsExec and WMI rule on certain server systems, and its attack surface reduction reference says not to enable that rule by other methods on devices managed with Configuration Manager, because that client relies heavily on WMI. Test before you roll it out broadly.
- Make staff stop at the elevation prompt. Tell people that a document, e-card or meeting link should never ask for administrator approval to install something. If it does, they should close it and report it to you.
What can wait
You do not need to hunt for the specific file hashes and domains Microsoft published unless you run a security team or use Defender advanced hunting. Those indicators change quickly. Controlling which remote-access tools can run at all is the more durable fix, and it covers variants Microsoft has not yet named.
You also do not need to remove remote-management software you rely on. The goal is to make it a short, known list with MFA, not to ban it.
Signs a PC may already be affected
- A remote-management or ScreenConnect client that nobody on your staff or vendor list installed.
- A program or service with “RMM Agent” in its name that you did not approve.
- Files delivered through ScreenConnect that are named to resemble Windows, Microsoft Defender or Phone Link components, such as WindowsSecurity_PIN.exe or WindowsPassKey.exe.
- ScreenConnect temporary folders under Documents or OneDrive, which Microsoft lists as staging locations.
- An employee who remembers approving an installer after clicking a document, invitation or software-update link.
Our own guidance, not Microsoft’s: if any of these turn up, disconnect the PC from the network, change the passwords for accounts used on it from a different, clean device, and get help before reconnecting it.
How we can help
Our engineers can inventory the remote-access tools on your network, set up application control and Defender rules without breaking the software your staff depend on, and review how your email filtering handles lures like these. Start with our cybersecurity services page or contact us.