Living off the Land

Microsoft: Phishing Campaigns Exploit Remote Management Tools to Establish Persistent Access to Devices

Microsoft observed phishing campaigns that distributed a legitimate MSP360 installer under deceptive names, then used it to install ConnectWise ScreenConnect and create two recurring remote-access channels. The company did not observe exploitation of a vulnerability in ScreenConnect; rather, the attackers abused trusted administrative tools to conduct subsequent activities, including information gathering and credential access.