Back Gbhackers

Threat Actors Exploit LogMeIn Resolve, ScreenConnect in Phishing Campaigns

Gbhackers •Mayura Kathir • April 7, 2026

Threat actors are abusing legitimate remote monitoring and management (RMM) tools LogMeIn Resolve and ScreenConnect in a multi‑stage phishing campaign that blends social engineering, living‑off‑the‑land techniques, and stealthy information‑stealing malware. Sophos’ Managed Detection and Response (MDR) teams first saw this activity in April 2025, with most malicious activity clustered in October–November 2025. More than 80 […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Exploits LogMeIn Resolve and ScreenConnect Tools Threat actors are leveraging the legitimate remote monitoring and management tools LogMeIn Resolve and ScreenConnect in a sophisticated phishing campaign. This multi-stage attack combines social engineering tactics with stealthy information-stealing malware. Sophos’ Managed Detection and Response (MDR) teams first detected this activity in April 2025, with a significant increase in malicious activity noted between October and November 2025. The campaign targets organizations primarily in the United States, aiming to bypass security defenses by using trusted software. Specific details regarding the number of affected organizations or systems have not been disclosed. The current status indicates ongoing exploitation of these tools in phishing attempts. Security professionals are advised to remain vigilant against such tactics. 2 sources 52

Extracted Entities

Threat Actors Exploit LogMeIn Resolve, ScreenConnect in Phishing Campaigns

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (1)

Tools (2)