CERT24Phishing campaigns abuse MSP360 and ScreenConnect for persistent remote accessLoading data…
CERT24Threat Observatory
Period

Phishing campaigns abuse MSP360 and ScreenConnect for persistent remote access

In July 2026, Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries with a deceptively named, digitally signed MSP360 RMM installer. After successful installation, MSP360 services were created and used to download and install ConnectWise ScreenConnect, providing a second remote-access channel. Microsoft did not observe exploitation of ScreenConnect itself; legitimate remote administration software was abused to maintain access and conduct follow-on activity.

← Back to intelligence

Phishing campaigns abuse MSP360 and ScreenConnect for persistent remote access

In July 2026, Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries with a deceptively named, digitally signed MSP360 RMM installer. After successful installation, MSP360 services were created and used to download and install ConnectWise ScreenConnect, providing a second remote-access channel. Microsoft did not observe exploitation of ScreenConnect itself; legitimate remote administration software was abused to maintain access and conduct follow-on activity.