Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks

Microsoft has issued a warning about phishing campaigns that distribute a malicious installer disguised as the legitimate MSP360 Remote Monitoring and Management (RMM) software. Attackers use social engineering lures such as meeting invitations, PDF-themed content, and fake software update prompts to trick users into executing the installer. Once run, the legitimate-looking MSP360 installer establishes unauthorized remote management access on compromised systems. The attack is notable for leveraging dual-RMM tactics, combining MSP360 with ScreenConnect to maintain persistent remote access. This technique allows attackers to blend in with legitimate IT activity, making detection more difficult. The campaign highlights the ongoing abuse of legitimate remote management tools by threat actors to evade security controls.