Phishing Campaign Exploits MSP360 and ScreenConnect for Remote Access

• •Attackers exploit MSP360 to deploy ScreenConnect via phishing emails.
• •The campaign utilizes social engineering tactics with familiar workplace themes.
• •Organizations should implement strict controls and multi-factor authentication for RMM tools.

A phishing campaign has been identified that abuses the MSP360 remote management software to gain persistent access to Windows systems. Attackers distribute a legitimate MSP360 installer disguised as trusted software, which, once executed, downloads and installs ConnectWise ScreenConnect, providing an additional remote access channel. The campaign employs social engineering tactics, using familiar workplace themes such as meeting invitations and software updates to lure victims. Microsoft security researchers detected this activity in July 2026, and the attackers utilized legitimate cloud services to host malicious payloads. MSP360 has since blocked accounts associated with this abuse and implemented stronger safeguards. The dual-RMM approach allows attackers to maintain access even if one tool is removed. Organizations are advised to enforce multi-factor authentication and application control policies to mitigate risks.