Remote Access - 1

2026 (2)

September (2)

security: Phishing Abuses RMM Tools for Persistent Access

Microsoft Security Blog

2026-09-29

Microsoft reported phishing campaigns that abused MSP360 RMM to deploy ScreenConnect and establish redundant remote-access channels for later malicious activity. The focus is on persistence and follow-on access rather than initial compromise alone.

security: Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft Security Blog

2026-09-02

Microsoft Threat Intelligence reported a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node.js-based implant. The campaign uses social engineering and legitimate tools to move from initial access to lateral movement, with Microsoft Defender used for detection and disruption.