Security1 publisher2 min readPublished
Attackers are phishing employees into installing rogue ITarian and ScreenConnect clients
Huntress says three of its SOC investigations began with document lures and ended with victims installing rogue ITarian and ScreenConnect clients, and its responders now find RMM abuse in almost 40% of the incidents they work.
The Watch · Security desk
What happened
- A Huntress SOC case began with a secure-document email from TransferXL that led to a ZIP file, which extracted a PDF built to trick the employee into installing a rogue ITarian client.
- ScreenConnect was dropped onto the same device soon after, and both clients were configured to persist with SYSTEM-level privileges, giving the intruder two routes back in.
- Two further investigations tied to a single phishing campaign used emails that named ScreenConnect openly, dressing the lure up as a document share sent via the tool.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision Removing the client you found does not close the incident when the pattern is two or three; the responder has to assume a second path exists and prove it is gone before standing down.
- exposure The user is the installation step here. An account with no stolen password and no failed MFA prompt can still end up hosting SYSTEM-level remote access for someone else.
- constraint Scoping cannot start at the day of detection: the five-month case puts the initial email outside any window a same-week triage would ever look at.
A rogue ITarian client and an approved one come from the same vendor, run the same processes, and talk to the same infrastructure, so telemetry alone will not tell you which one your IT team asked for [7]. That makes it an inventory problem. An allowlist keyed to the product name passes the intruder through, so what you need is the list of instance identifiers you authorised, plus an alert on anything from that vendor that is not on the list.
In the TransferXL case the second tool landed soon after the first, and both were configured to persist with SYSTEM-level privileges [2][3][4]. Huntress describes the stacking directly: the first RMM gives hands-on control, and the second or third gives a separate route back in if the first client is spotted and removed [8]. Its responders saw extra clients added quickly after initial access in all three investigations [12].
The dwell time changes the scoping. In a separate incident, an attacker returned to a ScreenConnect client that had been sitting undetected for five months, used it to reach the user's browser, and configured malicious inbox rules on their email [9].
On volume, Huntress reports a 277% spike in RMM abuse in 2025 and says its Tactical Response team now sees it in almost 40% of the incidents it investigates [10][11]. Read as a year-over-year increase, that puts 2025 at roughly 3.8 times the prior volume [14]. The post does not say what the 277% is measured against, and both figures come from one vendor's own customer base, so the trend is directional and the 40% is a share of that population.
Delivery was the ordinary part. A ZIP hosted on a legitimate cloud storage site, a PDF extracted from it, an embedded link inside the PDF, the arrangement chosen to get past the browser and common antivirus tooling [13]. Huntress also reports the operators using defensive evasion against security software once resident [15].
In two of the three cases the phishing emails named ScreenConnect openly, presenting the lure as a document share "via ScreenConnect" [5]. According to Huntress, the victims expected to view a document, not install an attacker-controlled persistent remote access client [6]. Awareness training rarely covers this: the software name in the email was real, and the installer worked exactly as the vendor built it [16].
What to watch
- Whether Huntress publishes the 2024 baseline behind the 277% figure, which would show how much of the rise is volume and how much is its own detection coverage.
- Whether the RMM vendors whose clients are being abused tighten trial signup and instance provisioning for unverified accounts.
- Whether the ScreenConnect-branded lure structure is reused with other RMM brands in the same campaign.