Cybersecurity
Microsoft linked phishing to MSP360 and ScreenConnect
Microsoft said phishing emails delivered disguised MSP360 installers that established remote access, added ScreenConnect, and used several cloud services and attacker infrastructure to stage the files.
- Microsoft said phishing campaigns distributed MSP360 RMM installers under deceptive file names and social-engineering lures.
- Microsoft said the installers established remote management access and then downloaded ConnectWise ScreenConnect.
- The activity was detected in July 2026 and was not attributed to any known threat actor or group.
- Microsoft said separate July 2026 attacks used Faronics Deploy Agent before installing ScreenConnect.
- The installer packages were staged on attacker-controlled infrastructure and on Amazon S3, Cloudflare R2, Dropbox, GitLab and Supabase.
Microsoft said phishing emails had delivered digitally signed MSP360 RMM v2.5.0.67 installers under deceptive names that imitated invitations, software updates and documents. It said the packages were staged on attacker-controlled infrastructure and on Amazon S3, Cloudflare R2, Dropbox, GitLab and Supabase.
According to Microsoft Security Research, execution of the installer had established remote management access on affected devices and given the operators an initial foothold. Microsoft said that foothold was then used to download and install ConnectWise ScreenConnect as a second remote-access channel.
Microsoft said the access had been used to transfer more executables and to carry out information collection and credential-access activity. It said the installer also ran PowerShell, created Windows services and autorun entries, and altered Windows Firewall to allow inbound UDP traffic on port 48678.
Microsoft said it had also seen separate attacks in July 2026 that used Faronics Deploy Agent to gain access and then install ScreenConnect. It said that pattern showed the use of multiple remote-management tools for access and persistence.
Named in this story
Companies
- Microsoft
- warned about the phishing campaigns and described the intrusion chain
- Dropbox
- hosted some of the installer packages
- GitLab
- hosted some of the installer packages
- Supabase
- hosted some of the installer packages
Organisations
- Amazon S3
- hosted some of the installer packages
- Cloudflare R2
- hosted some of the installer packages
Products and systems
- MSP360
- was the RMM software installed from the phishing lures
- ConnectWise ScreenConnect
- was installed to provide a second remote-access channel
- Faronics Deploy Agent
- was used in separate July 2026 attacks before ScreenConnect was installed
- Windows
- was the platform on which the installer created services and firewall changes
- PowerShell
- was invoked to install ScreenConnect
- Windows User Account Control
- was used to relaunch the installer with elevated privileges
- Windows Firewall
- was modified to allow inbound UDP traffic to MSP360
How the source tells it
The piece was a plain technical report with no sustained emotive framing.
No emotive framing was found in the original.