Microsoft: Phishers Deploy MSP360 and ScreenConnect in Dual-RMM Attacks

Microsoft warned of phishing campaigns that distribute a legitimate MSP360 RMM installer disguised as meeting invitations, PDF lures and software update prompts. Once executed, it grants remote management access, after which attackers deploy ScreenConnect in a dual-RMM scheme.

• MSP360 installer disguised as meeting invites and software updates
• Execution gives attackers remote management access to the host
• ScreenConnect is deployed as a second RMM for persistence