Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries that distributed legitimate RMM software via meeting invitations, PDF-themed lures, software update prompts, and other social engineering content. msft.it/6016acCYr After execution, the software established a remote management foothold and was used to deploy a second remote access platform, creating redundant access channels that supported persistent access and follow-on activity, including information collection and credential access operations. The activity highlights how threat actors continue to abuse legitimate administration tools to blend into normal IT operations while maintaining access and reducing detection opportunities. Read the full analysis for additional findings and guidance.