How RMM abuse gives attackers a way in that looks like business as usual

How RMM abuse gives attackers a way in that looks like business as usual Huntress found attackers using legitimate remote monitoring and management (RMM) software in 45% of the endpoint-related incidents it recorded in the first quarter of 2026. The security company also ranked 11 attack tactics by how often it sees them and how much damage each can do, and RMM abuse sits farthest right on the chart, the position for tactics it sees most often. IT teams use RMM tools to manage computers from anywhere, so an attacker who installs one gets persistent access and remote command execution that looks like ordinary administrator work. Huntress calls the category one hop from ransomware or data theft and says it jumped 277% year over year in 2025. The malicious copy and the approved one can behave the same way. One click, four tools In one case, a fake service agreement installed an RMM tool called Tiflux, and the intruder then stacked UltraVNC, Splashtop, and ScreenConnect on the same device. One phishing click gave the attacker several ways back in. The researchers say attackers already use AI to write fake document-share and service-agreement lures. “Why would you spend the cycles to develop or build from scratch when you can use a legitimate tool that you can just pull off the shelf?” said Jamie Levy, senior director of adversary tactics at Huntress. The researchers suggests a quick check: ask the security team which RMM tools are approved and what tips them off when an unapproved one appears. Hidden inbox rules and stolen session tokens Huntress puts mailbox manipulation and account takeover in the same top-right corner. In mailbox manipulation, an attacker inside an inbox creates a rule that sends a vendor’s replies to a folder like Archive, where they are easy to miss, then swaps in an invoice that redirects payment. In adversary-in-the-middle (AiTM) takeovers, the attacker sits between a victim and the real Microsoft 365 login page and copies the session token, the credential that keeps a user signed in. While that session stays valid, the attacker needs no password and triggers no MFA prompt. Mailbox manipulation made up 19% of identity-based threats in 2025 and 24.6% of identity threat signals so far in 2026. AiTM was 18.9% of identity-based threats in 2025. Those figures count different things than the 45% for RMM, which counts endpoint-related incidents, so they cannot be ranked against it. The researchers suggest asking IT how long sessions stay active and whether a new device or location forces a fresh login. Fake codes, fake CAPTCHAs, a fake Claude download Device code phishing sits in the “low-key deadly” corner, which Huntress reserves for tactics it sees less often but that do heavy damage. A fake workflow prompt sends someone to Microsoft’s real device code login, and once the victim enters the code, the attacker holds an access token that can survive a password reset. The researchers report a 1,380% increase year over year, but the periods compared are July through December 2025 and January through April 2026, and no starting count is given. The figure shows direction; with no base, it cannot show volume. The EvilTokens phishing kit hit 344 organizations across five countries in 16 days. ClickFix made up 53.2% of malware loader activity in 2025. Huntress files AI platform abuse and deepfakes under “overhyped, for now.” One AI platform case: FakeAgent used a malicious Claude Artifact hosted on the real claude.ai domain to send people looking for Claude Desktop to SectopRAT, hitting 29 organizations in two days. Six of the 11 tactics carry Huntress’s marker for AI acceleration, including both of those. Webinar: Closing the accountability gap in AI-assisted delivery