Microsoft finds attackers abusing signed MSP360 RMM installer to hijack Windows PCs

On September 29, 2026, Microsoft's security researchers published an analysis of a phishing campaign that used a digitally signed installer for MSP360 RMM, a legitimate remote management tool, to take control of Windows computers. The Hacker News reports that the installer was disguised under names such as "ZoomSetup_Installation" and "SSA.GOV_STATEMENT" and delivered through meeting invites, PDF-themed lures and fake software updates. Once installed, attackers used it to add a ConnectWise ScreenConnect client as a second access channel, then ran tools to collect information and credentials. Microsoft first detected the activity in July and has not attributed it to a known group.

This is not a flaw in MSP360. It is the misuse of a trusted IT tool. Because the installer is signed and the software is widely used by IT providers, it can look normal to users and to some security tools, which is exactly why attackers chose it.

Ask your IT provider which remote management and remote access tools are approved in your environment, and whether anything else is blocked or alerted on. An unexpected RMM agent or a second remote access tool appearing on a PC should be treated as an incident. Make sure staff know that a Zoom or Social Security statement download should never install software that asks for administrator rights.

Microsoft also saw attackers use another management product, Faronics Deploy Agent, the same way in separate July attacks. Inventory and allow-listing of remote tools is a practical control for any business, whether or not it uses an MSP.