NewsHive
CONTACT USANALYST PORTAL →
securityBACKGROUND

Phishing Campaign Hits 80+ Orgs Using SimpleHelp and ScreenConnect RMM Tools

BACKGROUND
2 SIGNALSFIRST DETECTED 4 May 2026
Narrative synthesis pending — 2 signals collected.
How the story developed
Other feeds and industry voices
4 Aug
Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access

Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business

REPORT · WHAT · The Hacker NewsOPEN STORY
1 Sept
Hackers abuse Faronics Deploy admin tool to install ScreenConnect

Phishing actors are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install the ScreenConnect

REPORT · WHAT · BleepingComputerOPEN STORY
7 Sept
Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts

Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to

REPORT · WHAT · The Hacker NewsOPEN STORY
30 Sept
US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access

ANY.RUN researchers traced a US-focused CSuite phishing campaign across 351 sandbox analyses, with 51% of submissions coming from the United States. Technology, manufacturing,

REPORT · WHAT · The Hacker NewsOPEN STORY
27 Jul
Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update

Cybersecurity researchers have flagged a Microsoft Teams-themed phishing campaign that employs "secure document" lures to deliver legitimate remote monitoring and management (RMM)

REPORT · WHO · The Hacker NewsOPEN STORY
1 Jul
SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT

Unknown threat actors are leveraging the ScreenConnect remote access tool as a way to deploy and execute AsyncRAT. Kaspersky said the activity is part of a "massive, multi-domain,

REPORT · WHO · The Hacker NewsOPEN STORY
6 Oct
More RMM Tools In the Wild, (Tue, Oct 6th)

It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat

REPORT · WHEN · SANS Internet Storm CenterOPEN STORY
5 Aug
COLDCARD security audit phishing attack installs remote access tool

A phishing campaign is exploiting fears surrounding the recently disclosed COLDCARD wallet vulnerability and suspected $88.6 million Bitcoin theft to trick users into installing

REPORT · WHAT · BleepingComputerOPEN STORY
Sources
The Hacker News×2

NewsHive monitors these sources continuously. All signal titles above link to the original reporting.

Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →