Threat Hunter: 2026-09-30

1. Phishing Abuses RMM Tools for Persistent Access

   Microsoft Defender Experts, 2026-09-29. Read, 16 min.

   Microsoft Defender Experts observed phishing campaigns in July 2026 that delivered a legitimate, digitally signed MSP360 RMM installer under deceptive file names, then used the MSP360 agent to install ConnectWise ScreenConnect as a second remote-access channel. Microsoft says it did not observe exploitation of ScreenConnect itself, and that the actors used these remote administration channels for post-compromise activity including information collection and credential access.

   Why it matters for this role: Query endpoints for MSP360 or ScreenConnect installations nobody approved, because in these campaigns one signed installer arrived under many file names before pulling in the second tool.

Threat Hunter