07/07/2026
If an email asks you to download a tool to "view a document," stop and verify before clicking.
A growing attack pattern is tricking employees into installing real IT software on their own machines.
The software is called RMM (Remote Monitoring and Management), and it lets IT companies remotely control computers for support purposes.
Tools like ConnectWise ScreenConnect, Datto RMM, SimpleHelp, N-able, and LogMeIn are all legitimate and digitally signed by reputable vendors.
That's exactly why attackers love them. Antivirus software doesn't flag them as malicious because they aren't malicious.
They're just being installed by the wrong person.
In February 2026, Microsoft documented a campaign that hit 29,000 users across
10,000 organizations.
The lure was a fake "IRS Transcript Viewer" email. The download was actually a repackaged ScreenConnect installer.
Once an employee ran it, the attacker had full remote control of their machine.
The same trick is being used with fake Zoom invites, fake Teams calls, and fake DocuSign emails.
A few things you can do:
Ask your IT provider to maintain an allow-list of approved RMM tools. Anything outside that list gets blocked from installing automatically.
Train your team that "download this viewer to see your document" is almost always a phishing attempt. Real documents don't require a new program.
Audit your endpoints for RMM software your IT provider didn't install. If you see something unfamiliar, flag it.
If you're not sure what RMM tools are running on your team's computers right now, that's the first thing to check this week.