The Attack: Legitimate Tools, Malicious Intent
A phishing operation spanning 46 countries is using fake tax documents, invoices, and DocuSign lures to trick victims into installing legitimate remote monitoring and management software. ANY.RUN researchers tracked 425 phishing-kit URLs across 240 hosts between February and July 2026, with 94% of those hosts appearing for only one day before rotating to new infrastructure.
The attack works because it abuses trusted software. Victims receive convincing business documents — tax notices, shipping updates, Adobe files — that lead to password-protected ZIP archives. Inside: VBS scripts that launch PowerShell to download real RMM products like ScreenConnect, AnyDesk, or RemotePC. Once installed, the attacker has administrative access to the victim’s system, and security tools see authorized software performing normal operations.
For MSPs, this creates a nightmare scenario. The same RMM platforms you use to manage client systems are the ones attackers are deploying. Your legitimate ConnectWise agent looks identical to the unauthorized ScreenConnect instance that just arrived via phishing email. Traditional detection fails because there’s no malicious signature to find — the software is genuine, the behavior is expected, and the evildoer blends into your normal IT operations.
Why Application Inventories Aren’t Enough
The article recommends maintaining an inventory of approved RMM products and using application allowlisting. Both are correct controls, but they operate downstream from the actual problem. By the time you’re trying to distinguish authorized RMM software from unauthorized installations, the payload has already landed on disk and potentially executed.
Application allowlisting also creates operational friction. You need to maintain the list, update it when tools change, handle exceptions for contractors and vendors, and somehow communicate approved software to every user who might encounter a phishing email. That’s not a criticism — it’s a necessary layer — but it’s not the earliest possible intervention.
The Upstream Fix: Block the Write Operation
FileSure Defend operates at the Windows kernel level via a filter driver that intercepts file operations before they reach the file system. When a VBS script launches PowerShell to download an RMM installer, that download is a file write operation. When the installer writes its executable components to Program Files, those are file write operations. FileSure sees all of them and enforces policy before the file exists.
Here’s a specific rule configuration that would have stopped this campaign:
Operation: Create, Write
File type: .exe, .msi, .dll
Source program: outlook.exe, chrome.exe, msedge.exe, firefox.exe, powershell.exe, wscript.exe, cscript.exe
Action: Deny and alert
This rule blocks email clients, browsers, and scripting engines from writing executable files to disk. The phishing email still arrives. The user might still click the link and download the ZIP file. But when PowerShell tries to write the RMM installer to the file system, FileSure intercepts the operation and blocks it. The payload never lands, so the remote session never happens.
For MSPs, you can layer a second rule that permits your specific RMM agent to write files while blocking everything else:
Operation: Create, Write
File type: .exe
Source program: * (all programs)
Exception: C:\Program Files\ConnectWise\agent.exe
Action: Deny and alert
Your legitimate management tool keeps working. Unauthorized RMM downloads are blocked at the kernel level. You get an alert showing which user, which program, and which file was attempted — evidence you can act on before the attacker gains access.
Why This Works Against Rotating Infrastructure
The campaign rotates domains and hosting infrastructure daily. Traditional blocklists can’t keep up — by the time a phishing URL is identified and added to a blocklist, the attackers have moved to new hosts. Signature-based detection fails because the payload is legitimate software with valid signatures.
FileSure doesn’t care about the domain, the URL, or the signature. It controls the file operation. Whether the RMM installer comes from a phishing email today or a different phishing email tomorrow, the write operation is the same, and the block happens the same way. The control is durable because it operates on behavior, not indicators.
This is the difference between whack-a-mole and structural defense. Chasing phishing domains is whack-a-mole. Controlling which programs can write executable files to your systems is structural.
For MSPs: Protection You Can Prove
If you manage client environments, this attack targets both you and your customers. An unauthorized RMM installation in a client system gives an attacker the same access you have — and your client won’t know the difference until the damage is done.
FileSure integrates with the RMM platforms you already use. Alerts feed into ConnectWise, NinjaOne, Kaseya, or Datto as tickets. You see the blocked attempt in your existing dashboard, investigate with the full audit trail, and close the ticket with documentation showing exactly what was stopped and when.
Every blocked payload is proof of value you can show the client. Not a theoretical threat — a real executable that tried to land on their system and got stopped before it could run.
Start a free 21-day trial at bystorm.com — full functionality, no credit card required. Install it on an RMM-monitored test system, send yourself a phishing simulation, and watch the block happen in real time.
Source: RMM Phishing Campaign Spans 46 Countries as Attackers Abuse Trusted IT Tools | eSecurity Planet
Category: Threat Intelligence
Tags: rmm abuse, phishing campaign, powershell payload delivery, kernel filter driver, file system security, msp security, application allowlisting
