Microsoft Warns: Hackers Hijack MSP360 in Sneaky Phishing Attacks

Robert Moore · 2026-09-30

Microsoft just dropped a warning that should make anyone in IT sit up straight. Hackers are using a legitimate remote monitoring tool called MSP360 to sneak into networks, and they're doing it through some pretty convincing phishing emails. ### What's Actually Happening? Picture this: you get an email that looks like a meeting invite. Or maybe it's a PDF you weren't expecting, or a prompt to update your software. You click, you download, and boom—you've just handed over remote access to your entire system. That's the play here. The attackers are distributing the real MSP360 installer, but they've renamed it to look like something harmless. Once that installer runs, it quietly sets up remote management access. And because MSP360 is a legitimate tool, it often flies under the radar of traditional security software. That's what makes this so dangerous. ### Why Dual-RMM Attacks Are a Big Deal Here's where it gets even trickier. The attackers aren't just using MSP360. They're also deploying ScreenConnect, another remote management tool. So you've got two RMMs running side by side—one might be detected, but the other could slip through. It's like having two sets of keys to your house, and the burglar only gets caught with one. According to Microsoft's warning, these campaigns are using a mix of social engineering tactics: - Fake meeting invitations that look like they're from colleagues - PDF-themed lures that seem like important documents - Software update prompts that appear legitimate - Other urgent-sounding messages designed to make you click without thinking ### How to Protect Yourself The good news? You don't have to be a sitting duck. Here are a few practical steps: - **Verify before you click.** If you get an unexpected meeting invite or file, reach out to the sender through a separate channel. A quick Slack message or phone call can save you a world of hurt. - **Train your team.** Phishing works because it preys on human nature. Regular training—especially around RMM tools—can make a huge difference. - **Monitor for unauthorized RMM installs.** If MSP360 or ScreenConnect suddenly shows up on a machine that shouldn't have it, that's a red flag. - **Use endpoint detection and response (EDR) tools.** They can catch suspicious behavior even when the software itself is legitimate. ### The Bottom Line Attackers are getting smarter. They're not just using malware anymore—they're weaponizing the tools we trust. MSP360 is a great piece of software, but in the wrong hands, it becomes a backdoor. Stay vigilant, question everything, and keep your defenses sharp. Remember: if something feels off, it probably is. Trust your gut, verify the source, and don't let a fake meeting invite ruin your day.