ThreatVectr
Tag

#RMM abuse

5 stories taggedRMM abuse.

A global map projection showing phishing attack origins and target locations as glowing lines and nodes, with North American targets highlighted in bright red,
Threat Intelligence

US Now Top Target in Global Phishing Campaign That Hijacks Remote Access Tools

A phishing operation first spotted using fake Canadian tax notices has spread to 46 countries, with nearly half of all sightings hitting American inboxes.

3 min read
A corporate employee desktop with ScreenConnect remote-access tool running in the background while antivirus software shows a clean status, attacker command pro
Threat Intelligence

Hackers Are Using a Legitimate Remote-Access Tool to Spy on Companies, and Your Antivirus Won't Notice

The Smoke#Screen campaign tricks employees into installing ScreenConnect, a genuine remote-support program, which then hands criminals full control of the victim's computer while looking completely normal to security software.

4 min read
A user's desktop showing what appears to be legitimate Adobe and Zoom update prompts in the notification area, while system tray indicators and background proce
Threat Intelligence

Fake Adobe and Zoom Update Prompts Slip Remote-Control Software Onto Victim PCs

Securonix researchers say the SMOKE#SCREEN campaign is tricking staff into installing ConnectWise ScreenConnect, handing attackers a quiet way back in.

3 min read
Illustration: a laptop on a dark wooden desk with a generic software installer progress bar glowing on screen
Threat Intelligence

ScreenConnect Turned Loader: Trojanized Installers Push AsyncRAT via Spoofed Software Sites

A sprawling campaign is abusing a signed RMM binary to sideload AsyncRAT onto victims chasing free copies of OBS Studio, Bandicam, and other utilities, Kaspersky says.

3 min read
Illustration: a generic laptop screen glowing in a dim office
Threat Intelligence

WhatsApp DMs Push VBScript Loaders That Deploy Legitimate RMM Tools

An active campaign abuses WhatsApp Desktop and Web to distribute scripted droppers that install commercial remote-management software across at least nine jurisdictions.

3 min read
© 2026 Threat Vectr