Phishing Campaigns Misuse RMM Tools to Maintain Stealthy Access

Malicious actors are exploiting Remote Monitoring and Management tools such as ITarian, PDQ Connect, SimpleHelp, Atera, and ConnectWise ScreenConnect, to embed long-lasting remote access inside compromised systems. These operations make use of highly convincing phishing lures—fake browser-updates, meeting or party invitations, government or tax forms—to trick users into installing legitimate-looking software that gives attackers administrator-level control.

Phishing pages often mimic trusted brands or meeting applications like Microsoft Teams and Zoom, with AI-generated content, obfuscated URLs, or hijacked email threads increasing their plausibility. Once the initial RMM tool is installed, attackers sometimes dispatch additional RMM tools in succession to ensure persistent access even if one is detected or removed.

Security-research teams have noticed a shift towards using RMM tools not just for initial compromise, but to blend malicious activities with ordinary administrator behaviour. Because many organisations already use RMM solutions for maintenance, patching, or remote support, abnormal use often goes unnoticed.

Among the tools frequently misused are ConnectWise ScreenConnect—which figures prominently in spear-phishing campaigns targeting over 900 organisations through fake Zoom/Teams invites—and ITarian, PDQ Connect, SimpleHelp, and Atera, which are delivered via deceptive lures.

Some attack chains begin with phishing emails that embed lure pages that host malicious MSI or EXE installers masquerading as legitimate RMM packages. Installation often occurs silently or with minimal user suspicion. Attackers also make use of trusted hosting platforms or compromised legitimate email senders to reduce detection probability.

Detection is complicated by the fact that these tools are signed, legitimate, and often used in organisational IT environments. Indicators of compromise may include RMM executables running from unexpected directories, installer files having unusual names or being hosted on domains not clearly tied to the vendor, or the presence of multiple RMM tools installed in quick succession. Organisational allow-list or block-list policies, endpoint visibility, and monitoring process command lines are among the mitigations being advised.