Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks

Microsoft has issued a warning about phishing campaigns that distribute MSP360 Remote Monitoring and Management software installers disguised as meeting invitations, PDF files, or software updates. The legitimate MSP360 installer is being distributed with a deceptive file name. When executed, the installer establishes remote management access on affected systems. The goal of these campaigns is to deploy ScreenConnect, although the specifics of this deployment are not detailed. The attacks are characterized as dual-RMM phishing attacks, indicating the involvement of multiple remote monitoring and management tools. These phishing campaigns rely on social engineering tactics to trick victims into executing the installer.