Attackers are turning legitimate IT support software into a route for remote access. Because RMM tools are widely used by administrators and service providers, malicious activity can blend into normal IT operations.
A newly documented RMM phishing campaign has appeared across 46 countries, with about 45% of observed activity associated with the United States, according to security researchers at ANY.RUN. The operation uses fake tax documents, invoices, and other business-themed lures to persuade victims to install legitimate remote monitoring and management software.
Research published Aug. 25 by ANY.RUN traced activity to January 2026 and identified 425 phishing-kit URLs across 240 hosts between Feb. 5 and July 29. Of those hosts, 225, or 94%, appeared for only one day. Similar abuse surfaced in a DocuSign phishing campaign delivering legitimate RMM tools to Windows and macOS, showing how attackers can use familiar business workflows to push trusted administrative software.
How the campaign gains remote access
The lures impersonate tax agencies, Social Security communications, Adobe documents, invoices, shipping notices, and DocuSign files. Some attacks use password-protected ZIP archives containing VBS scripts that launch PowerShell to download legitimate RMM software.
ANY.RUN observed multiple remote-management products rather than one standard payload. Defenders therefore need to watch for unexpected RMM execution, suspicious scripting, outbound connections, and remote sessions on systems where those tools are not normally used.
MITRE ATT&CK tracks this behavior as Remote Desktop Software, T1219.002, covering adversaries that use legitimate desktop-support applications for interactive command and control.
CISA documented a different route into RMM infrastructure in a June 12, 2025 SimpleHelp advisory. The agency said ransomware actors likely exploited CVE-2024-57727 in unpatched SimpleHelp deployments used by a utility billing software provider, affecting downstream customers. SimpleHelp versions 5.5.7 and earlier were vulnerable.
The SimpleHelp case involved exploitation rather than phishing, but both paths can give attackers remote administrative access. Other RMM platforms face similar risk when flaws remain unpatched; a ConnectWise Automate vulnerability disclosed in May could allow integrity-check bypass and remote code execution in affected on-premises environments.
Reducing RMM exposure and improving detection
CISA, the NSA, and MS-ISAC have previously warned about malicious RMM use after documenting phishing attacks that delivered legitimate remote-management software. Weak credentials and exposed remote services continue to give attackers footholds, making RMM governance part of a broader access-control problem.
Organizations can reduce exposure through layered controls:
- Maintain an inventory of approved RMM products, MSP connections, third-party access, and embedded vendor tools.
- Patch vulnerable RMM systems promptly, isolate potentially compromised servers, and remove unnecessary internet exposure.
- Use application allowlisting to permit only authorized remote-access software and disable tools that are not required.
- Require approved remote access to use controlled paths such as VPNs or virtual desktop infrastructure.
- Monitor for unexpected RMM execution, suspicious PowerShell activity, outbound beaconing, new remote sessions, and persistence.
- Segment networks to limit lateral movement if an endpoint or management platform is compromised.
- Test incident response plans with RMM-abuse scenarios covering isolation, access revocation, evidence preservation, persistence hunting, and clean recovery.
MITRE’s remote desktop detection guidance recommends correlating RMM execution with unexpected outbound beaconing or remote-session establishment.
The operational challenge is authorization, not simply detection. Enterprises that permit several RMM platforms across internal IT teams, MSPs, and vendors create more legitimate remote-access activity for security teams to distinguish from attacker behavior. Reducing unnecessary RMM overlap and documenting who can use each platform can narrow that detection gap before an incident occurs.
Attackers can rotate domains and remote-access products faster than defenders can maintain individual blocklists. Accurate inventories, behavioral monitoring, segmentation, and tested response procedures are more durable defenses against both malicious installations and compromised management infrastructure.
Read more: Phishing campaigns increasingly abuse trusted services and short-lived infrastructure, as seen in attacks targeting session tokens and delivering malware.