Back Cybersecuritynews

Threat Actors Abuse LogMeIn Resolve and ScreenConnect in Multi

Cybersecuritynews •Tushar Subhra Dutta • April 7, 2026

A carefully crafted phishing campaign has been targeting organizations across the United States, using trusted remote monitoring and management (RMM) tools to slip past security defenses and gain unauthorized access to victim systems. Rather than deploying traditional malware at the outset, the threat actors behind this operation weaponized legitimate software — specifically LogMeIn Resolve and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Exploits LogMeIn Resolve and ScreenConnect Tools Threat actors are leveraging the legitimate remote monitoring and management tools LogMeIn Resolve and ScreenConnect in a sophisticated phishing campaign. This multi-stage attack combines social engineering tactics with stealthy information-stealing malware. Sophos’ Managed Detection and Response (MDR) teams first detected this activity in April 2025, with a significant increase in malicious activity noted between October and November 2025. The campaign targets organizations primarily in the United States, aiming to bypass security defenses by using trusted software. Specific details regarding the number of affected organizations or systems have not been disclosed. The current status indicates ongoing exploitation of these tools in phishing attempts. Security professionals are advised to remain vigilant against such tactics. 2 sources 52

Extracted Entities

Threat Actors Abuse LogMeIn Resolve and ScreenConnect in Multi

The full story

Extracted Entities

Attack Types (1)

Countries (1)

MITRE ATT&CK (1)

Tools (2)