Phishing Lures Deploy Stacked Rogue RMM Tools for Persistent Access
Summary
Huntress describes three phishing incidents in which attackers installed multiple rogue RMM clients, including ITarian and ScreenConnect, to maintain persistent access. The lures used document-themed pages and legitimate services to disguise the installations.
Key points
- A secure-document lure delivered a ZIP containing a PDF that prompted installation of a rogue ITarian client; attackers later added ScreenConnect.
- In two other incidents, phishing pages impersonated document shares and redirected victims to infrastructure that installed rogue ScreenConnect clients.
- Attackers added multiple RMM clients to create backup access paths if one was detected or removed.
- The clients were configured for persistence with SYSTEM-level privileges; attackers also used defense-evasion binaries.
- Huntress reported a 277% increase in RMM abuse in 2025, and said it appeared in nearly 40% of the incidents its Tactical Response team investigated.
- One undetected ScreenConnect client was used five months after installation to access a user's browser and create malicious email inbox rules.
- Huntress recommends maintaining an inventory of approved RMM tools and investigating how clients were installed, what they connect to, and whether they belong in the environment.
Article Details
- Attack Vectors
- Phishing emails used document-sharing lures to lead victims to malicious content and prompt installation of rogue RMM clients.
- A malicious PDF nested in a ZIP file contained an embedded link intended to evade browser and antivirus detection.
- In two incidents, clicking a “View Document” button on a document-share lure redirected victims to attacker-controlled C2 infrastructure that deployed a payload installing a rogue ScreenConnect client.
- After gaining access through an initial rogue RMM client, attackers installed additional rogue RMM clients to create redundant persistent access paths.
- Defensive Notes
- Maintain an inventory of approved RMM tools and investigate whether each installation, connection, and user activity belongs in the environment.
- Look beyond the presence of a familiar RMM product: examine how it arrived, who installed it, what it connects to, and whether the installation is approved.
- Check for additional rogue RMM clients during remediation; removing the first client may leave other attacker access paths active.
- Huntress recommends using RMM Guard to inventory RMM tools across Windows endpoints and identify clients that do not belong.
MITRE ATT&CK
T1204.002 · Malicious FileVictims were prompted to open a malicious PDF or click “View Document,” leading to installation of rogue RMM clients.T1219 · Remote Access ToolsAttackers installed rogue ITarian and ScreenConnect clients to gain remote access and maintain redundant access paths.T1566.002 · Spearphishing LinkPhishing emails linked to document-share lures that led victims toward rogue RMM installations.
People
Products
Adobe InDesignThe phishing links led to a legitimate (but abused) domain for an Adobe InDesign-hosted lure page that impersonates a document share and prompts the user to click the "View Document" buttonITarianthe file they opened would lead to an attacker's successful intrusion, ultimately installing a rogue ITarian client, followed by a ScreenConnect session for persistent access. ScreenConnectto an attacker's successful intrusion, ultimately installing a rogue ITarian client, followed by a ScreenConnect session for persistent access.