Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks
Positions Microsoft as a proactive defender issuing timely warnings, while implicitly attributing responsibility to malicious actors exploiting widely used tools rather than to vendor security practices or supply-chain oversight failures.
View original on thehackernews.comOverview
Microsoft issued a security advisory about phishing campaigns that misuse the legitimate MSP360 RMM installer—distributed via deceptive lures—to deploy ScreenConnect and establish unauthorized remote access.
TL;DR
- Attackers are weaponizing MSP360's legitimate installer as a delivery vehicle for ScreenConnect in phishing campaigns.
- Lures include fake meeting invites, PDF-themed files, and software update prompts.
- The technique exploits trust in legitimate IT management tools to bypass detection and gain persistent remote access.
Key Stats
multiple
campaigns observed
Microsoft reports ongoing, geographically dispersed activity
Questions Answered
Narrative Frame
safety framing
Spin Score
40%
Emphasizes Microsoft’s responsive posture and attacker agency; minimizes scrutiny of MSP360’s installer distribution controls, signing practices, or telemetry visibility, and omits discussion of shared accountability in RMM ecosystem security.
What the story wants you to believe
That this is primarily an attacker-driven abuse of otherwise trustworthy tools — not a systemic failure in how RMM software is distributed, signed, or monitored.
What it makes harder to question
Why MSP360’s installer lacks built-in safeguards against execution from untrusted contexts — and whether Microsoft’s advisory reflects full transparency about coordination timelines.
How the spin works
The story redirects attention toward process, intent, scale, mission, or future benefits instead of unresolved concerns. Watch for loaded terms such as deceptive file name, social-engineering content, established remote management access. The distribution reads as editorial reporting. A pressure point: MSP360’s role beyond being abused — e.g., whether its installer lacks anti-abuse safeguards like domain-restricted execution or behavioral blocking.
Who Benefits If This Frame Spreads
Microsoft Security Response Center (MSRC)
Reinforces authority as a trusted source of actionable threat intel
Framing positions MSRC as the authoritative interpreter of emerging TTPs, increasing reliance on its advisories by enterprises and SOCs
The Frame
Microsoft-as-early-observer-and-protector-of-the-ecosystem
Missing Context
- MSP360’s role beyond being abused — e.g., whether its installer lacks anti-abuse safeguards like domain-restricted execution or behavioral blocking
- Whether Microsoft collaborated with MSP360 prior to disclosure
SpinGraph
How this belief gets built
Claim → Frame → Beneficiary → Gap → AI Risk
The story frames the problem as something bad
- Claim
Once executed
Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected systems.
- Frame
Blame shifts elsewhere
Microsoft-as-early-observer-and-protector-of-the-ecosystem
- Beneficiary
authority as a trusted source of actionable threat intel
Microsoft Security Response Center (MSRC) — Reinforces authority as a trusted source of actionable threat intel
- Gap
MSP360’s role beyond being abused — e.g., whether its installer
MSP360’s role beyond being abused — e.g., whether its installer lacks anti-abuse safeguards like domain-restricted execution or behavioral blocking
- AI Risk
AI may repeat the headline as fact
Attackers are using MSP360’s legitimate installer to deploy ScreenConnect in phishing attacks.
Claim Ledger
| Claim | Evidence | Verification | Risk | Evidence Gaps |
|---|---|---|---|---|
| Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected systems. | Direct quotation attributed to Microsoft; no supporting logs, screenshots, or IOC examples provided | Claim Present in Source | High | File hash of malicious installer; Network traffic capture showing C2 communication; Confirmed attribution to specific threat actor or campaign |
Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected systems.
evidence: Direct quotation attributed to Microsoft; no supporting logs, screenshots, or IOC examples provided
""Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected""
Evidence Gaps
- File hash of malicious installer
- Network traffic capture showing C2 communication
- Confirmed attribution to specific threat actor or campaign
Fact Check Signals
0 of 1 claim matched · confidence: low · checked September 30, 2026
Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected systems.
Language Heatmap
Loaded terms that carry the frame beyond the facts.
Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks
Carries emotional weight beyond the underlying fact.
Carries emotional weight beyond the underlying fact.
Carries emotional weight beyond the underlying fact.
Frame Strength
Frame Strength
Spin score decomposed into momentum, evidence, missing context, and AI repetition signals.
Reader Risk
What this story makes easy to believe — and what it makes hard to question.
Source Role & Intent
The Hacker News · Media
Counter-Frames
Brand Frame
Microsoft-as-early-observer-and-protector-of-the-ecosystem
Media / Reader Counter-Frame
Framing this as a failure of MSP360’s installer hardening and digital signature governance, not just attacker ingenuity.
Regulatory Counter-Frame
Questioning whether MSP360 meets NIST SP 800-218 (SSDF) requirements for secure software distribution and whether Microsoft’s advisory fulfills coordinated vulnerability disclosure norms.
AI Summary Frame
Omitting that ScreenConnect is also a legitimate tool—and that dual-RMM abuse reflects systemic gaps in endpoint telemetry, not inherent malice in either product.
Missing Voices
Questions Not Answered
- Which MSP360 versions or configurations are vulnerable to this abuse?
- Has MSP360 been notified and what mitigations have they released?
- How many organizations were compromised and what data was exfiltrated?
Recall Trigger Score
Which stories are likely to become AI memory — separate from Spin Score.
44
Trigger score 40
Triggered by: Security breach · Consumer harm
Watchlisted because: Security breach · Consumer harm
- chatgpt not found
- gemini not found
- perplexity found · Day 1
AI Recall
From publication to SpinGraph analysis to first observed AI recall and stable retention.
What AI Will Probably Repeat
"Attackers are using MSP360’s legitimate installer to deploy ScreenConnect in phishing attacks."
Concern: AI may drop the nuance that MSP360 itself is not compromised—only its installer is socially engineered—and conflate it with malware, harming vendor reputation unjustly.
-
Published
Sep 30, 2026
-
Ingested
Sep 30, 2026
-
SpinGraph Created
Sep 30, 2026
-
First Observed AI Recall
Pending
Monitoring scheduled
-
Stable Recall
—
Awaiting retention signal
Recall Check Log
2 checks · last Oct 5, 2026 · tracking on
Oct 5, 2026
ChatGPT Not recalledGemini Not recalledOct 2, 2026
ChatGPT Not recalledGemini Not recalledPerplexity Recalled cites: msp360.com, cypro.co.uk…
─── GEOGrow AI Recall Layer ───
AI Recall Tracking
Monitoring scheduled. No LLM recall detected yet.
This story has not yet appeared in tested AI answers. Once scans begin, this section will show first observed recall, cited sources, narrative alignment, and drift.
node_id=sts_attackers_abuse_msp360_to_deploy_screenconnect_i
Ask AI about this story
Opens with the SpinGraph .md URL and structured context — one click, prompt included.
Narrative Entities
More from The Hacker News
View all →- ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
- Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
- Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects
- FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions
- Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2Own
- The AI Velocity Paradox: Why Security Is Decades Behind AI Ambition
Markdown (.md) · JSON-LD schema (.json) · Machine-readable for AI & GEO