Researchers documented a phishing campaign that installs a legitimate remote access tool, hides it from view, restarts it automatically on every login, then deletes its own tracks, leaving almost nothing behind for an investigator to find.

 

What happened

Researchers have identified a phishing campaign that uses a fake invoice email to install AnyDesk, a widely used legitimate remote access tool, and quietly configure it for long-term unattended access without deploying any custom malware in the process. According to CyberSecurityNews, the attack begins with an email carrying a password-protected archive labeled as an invoice, with the password placed directly in the message body so the victim can open it while automated security scanners cannot inspect the contents inside. The archive contains an installer built with a legitimate packaging tool that drops files into a hidden folder while displaying a decoy PDF to maintain the illusion of a real invoice. A series of scripts then run one after another, downloading a second password-protected archive containing the actual attack tools, including a portable copy of AnyDesk and a small program that hides application windows from the person using the infected device.

 

Going deeper

Once the download completes, the script pauses for about a minute, likely to outlast the automated security checks that scan files for a short window before releasing them. It then configures AnyDesk with a preset password so the attacker can connect without any confirmation prompt appearing on the victim's screen, launches it in the background using the hiding tool, and packages AnyDesk's connection settings and certificates into a new password-protected archive. That archive is emailed out to an attacker-controlled address through a legitimate email-sending utility, giving the attacker everything needed to reconnect later. A scheduled task disguised as a routine update process ensures the hidden remote access tool restarts automatically every time the victim logs back into their device. After persistence is established, the script deletes the command files, logs, archives, and decoy PDF used during setup, removing most of the evidence an investigator would normally rely on to reconstruct what happened.

 

What was said

Researchers stated in their analysis cited by CyberSecurityNews that using the window-hiding tool to keep AnyDesk out of sight is an effective evasion trick, since the remote access software itself is legitimate, and many security products will not flag it. Researchers noted the combination of scheduled task persistence and thorough file deletion favors blending into normal system activity over deploying anything that would obviously read as malicious code.

 

In the know

Abusing legitimate remote access software after tricking a victim into installing it themselves has become one of the more consistent patterns in phishing campaigns throughout 2026. According to The Register, a separate campaign documented the same week used fake internal chat messages impersonating IT support to persuade victims into handing over remote control and installing tools, including AnyDesk, which was then used to deliver a remote access trojan. The consistent thread across both campaigns is the same underlying advantage, because the installed software is genuinely legitimate, it does not trigger the alerts that custom-built malware would, leaving persistence and file-deletion patterns as the clearest signals defenders have to work with.

 

The big picture

A campaign built entirely out of legitimate, widely available tools is difficult for signature-based security software to catch, because there is no unique malicious file for that software to recognize. For healthcare organizations, the risk sits in exactly the layer that many security programs pay the least attention to, unexpected scheduled tasks and unapproved remote access installations on ordinary staff devices. A billing coordinator or clinical administrator who opens a password-protected invoice attachment and unknowingly installs a hidden, auto-restarting remote access connection has handed an attacker standing access to their device with no obvious symptoms to notice. According to Paubox's 2026 Healthcare Email Security Report, only 5% of known phishing attacks are reported by employees to security teams, meaning a quiet, self-cleaning intrusion like this one is unlikely to be caught through staff reporting and depends entirely on technical monitoring to detect.

 

FAQs

Why does password-protecting the malicious attachment help it bypass email security scanners?

Most email security tools scan attachment contents automatically before delivery, but cannot open a password-protected archive without knowing the password. Placing the password in the email body rather than the attachment lets the human recipient open the file normally, while the automated scanner is left unable to inspect what is actually inside.

 

Why is it harder for antivirus software to flag an attack that uses a legitimate tool like AnyDesk?

Antivirus and endpoint security products generally build detection around identifying known malicious files. AnyDesk is genuine, widely used business software with a legitimate purpose, so most security tools do not flag its presence or normal operation, even when an attacker, rather than an authorized administrator, configured and launched it.

 

What is scheduled task persistence, and why does disguising it as a routine update matter?

A scheduled task is a built-in Windows feature that automatically runs a program at a set time or trigger, such as every time a user logs in. Disguising a malicious scheduled task with a name that resembles a normal system update makes it far less likely that an IT administrator glancing through a list of scheduled tasks would notice or investigate it.

 

Why does deleting logs and setup files after the fact make this attack harder to investigate?

Forensic investigators typically reconstruct how an intrusion occurred by examining the files, logs, and scripts left behind during the attack. When a script deliberately deletes those artifacts once persistence is established, investigators are left with very little direct evidence, forcing them to rely on indirect signals such as network activity or the presence of the scheduled task itself.

 

What is the most reliable way for an organization to detect this type of attack?

Since the tools involved are legitimate software rather than identifiable malware, behavioral monitoring focused on unexpected scheduled task creation, unapproved remote access software installations, and unusual outbound email or archive activity offers a more reliable detection path than signature-based antivirus scanning alone.