Microsoft warns phishing attacks install two remote administration tools

Microsoft has warned that phishing campaigns use deceptive meeting invitations, PDF lures and software update prompts to install legitimate MSP360 remote management software, then add ConnectWise ScreenConnect as a second access channel. The Hacker News reports that Microsoft detected the intrusion chain in July 2026. Attackers use MSP360 to execute PowerShell and install ScreenConnect, then transfer tools and collect information and credentials. The installer establishes persistence through Windows services and automatic startup entries. Microsoft also observed attacks substituting Faronics Deploy Agent for MSP360. The activity has not been attributed to a known threat actor or group.