Microsoft found installations failed wherever the user declined the Windows permission prompt, and completed wherever they approved it.

 

What happened

Phishing campaigns running in July 2026 delivered a genuine, digitally signed copy of MSP360 remote management software to organizations across several industries, disguised under filenames made to look like business documents, Microsoft reported on September 29. Remote management software is what IT departments use to administer computers from a distance, covering remote command execution, software installation, and file transfer. Lure themes included meeting requests, video conferencing installation prompts, PDF reader updates, RSVP invitations and e-cards, job offer documents, signature requests, and package delivery notices, alongside one file named to resemble a Social Security Administration statement. Microsoft has not attributed the activity to any named group.

 

Going deeper

Not every execution produced an infection. The installer requires elevated privileges and triggers the Windows User Account Control prompt, the dialog asking whether an application may make changes to the device. Where the user approved it, the software installed, registered two Windows services for persistence, created registry entries so its components would launch at sign-in, and added a firewall rule permitting its own network traffic. Where the elevation was denied or abandoned, the installation stopped before any of that happened, according to Microsoft, which recorded initialization activity followed by a prompt for administrative rights and no further sign of the persistence mechanisms present in successful cases.

 

What was said

Attackers "continue to abuse legitimate remote administration software to blend into normal IT operations while maintaining persistent access and reducing detection opportunities," Microsoft wrote in its analysis. The company noted that it did not observe any flaw being exploited in the software itself, and that the certificate used to sign the installer has since been removed.

 

In the know

One remote access tool was used to install a second. After the first took hold, its agent launched PowerShell to download an installer package and run it silently, which placed a ConnectWise ScreenConnect client on the machine and gave the attacker a separate remote channel independent of the first, Microsoft found. Files transferred through that second channel carried names resembling Windows and security components, including DefenderControl.exe, WindowsSecurity_PIN.exe, and WebBrowserPassView.exe, alongside utilities for hiding the mouse cursor, banners, and control panel entries. Several are associated with credential theft and with reducing what a person sitting at the machine would notice. Microsoft observed the same pattern during July using a different first-stage tool, which indicates the approach is not tied to one product.

 

The big picture

Blocking software by its publisher rather than by its file is the control Microsoft puts first. Its guidance covers using Windows Application Control or AppLocker to block unapproved IT management tools through publisher rules, which work on digitally signed files, and using Microsoft Defender for Endpoint to block specific signed applications by certificate, in the mitigations published with the research. It also advises searching for unapproved remote management installations already present and resetting passwords for any account used to install them. CISA, the NSA, and the Multi-State Information Sharing and Analysis Center recommend auditing which of these tools are installed and blocking connections on their default ports for any that are not authorized, in a joint advisory. For healthcare organizations, the second question is who can approve the Windows permission prompt, since clinical workstations are frequently configured with local administrator rights for legacy application compatibility, and that setting decides whether the prompt is a barrier or a formality.

 

FAQs

Why would attackers use legitimate software instead of malware?

It is signed by a real company, it appears in no malware database, and its behaviour resembles ordinary IT administration. Security tools built to recognize malicious code have nothing to recognize.

 

What does the User Account Control prompt actually do?

It asks permission before an application makes changes requiring administrator rights. A standard user account cannot approve it without administrator credentials, which is why the prompt stopped the installation in the unsuccessful cases Microsoft recorded.

 

How would an organization find unapproved remote management software already installed?

By listing every remote access product present across its devices and comparing that against the products it authorized. Most organizations discover during the exercise that several unapproved tools are already running, installed by departments or vendors without review.

 

What does blocking by publisher certificate involve?

Creating a rule that refuses software signed by a particular company rather than blocking individual files. Because attackers distribute the same signed installer under many filenames, a file-based block fails while a publisher-based one holds.

 

Should staff have local administrator rights on clinical workstations?

Removing them prevents a user approving the elevation prompt at all, which stops this class of installation outright. Some clinical applications genuinely require elevated rights, so the practical approach identifies those cases and grants the permission narrowly rather than leaving it on by default.