Two legitimate tools, one unauthorized operator
Microsoft reported September 29 on phishing campaigns it observed in July that distributed a legitimate MSP360 remote-management installer under deceptive names. The company says attackers used the resulting access to install ScreenConnect, creating a second remote-control channel. Microsoft did not observe exploitation of ScreenConnect itself in this activity; the issue was unauthorized use of legitimate administrative software.
Trust needs an owner
The reported lures included invitations, document themes and software-update prompts. A digital signature can identify software’s publisher without proving that the person installing or operating it has the customer’s permission. That distinction matters when security tools encounter a remote-support product already familiar to the business.
Give every approved agent a business record
Our recommendation for small businesses and professional-services firms is an approved remote-access register. Each tool should have an owner, a support provider, a purpose and a way to verify the controlling account. The register should be usable by the help desk during an unexpected installation alert. An MSP should also explain how a customer can independently confirm a real support request, especially when the request arrives during a busy meeting or asks for immediate elevation.
Investigate the second access route
An incident exercise should ask what happens after the first unwanted agent is removed. Which other software was installed, which accounts were used and which remote sessions occurred? Assign responsibility for reviewing those questions and documenting what evidence is available. A customer should not receive a clean bill of health solely because the initially reported executable disappeared. At the same time, avoid indiscriminately blocking every remote-support tool without accounting for the business’s approved service arrangements. The operational objective is a narrow, auditable set of authorized paths and a rapid response when a new one appears. This gives MSPs a concrete way to demonstrate control over remote access rather than relying on product familiarity as reassurance.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
