Screensaver Files Used to Deploy Unauthorised RMM Tools in New Phishing Campaign

Du'aine Davis

Observed in the wild

• A spearphishing campaign observed across multiple organisations delivers business‑themed Windows screensaver (.scr) files via trusted cloud hosting services. When executed, these files silently install legitimate but unauthorised remote monitoring and management (RMM) agents, enabling persistent interactive access.
• Attackers send targeted emails linking to externally hosted .scr files disguised as documents (e.g., invoices). These overlooked executable formats install RMM tools to establish command‑and‑control. The technique exploits trust in cloud services and the permissiveness of RMM software, evading reputation‑based and signature‑based controls. Attribution remains unconfirmed, but the tradecraft is scalable, repeatable, and easily adapted by multiple threat groups.
• Organisations are advised to treat .scr files as privileged executables: block execution from user‑writable paths via Microsoft Defender Application Control or AppLocker. Maintain strict allowlists for approved RMM tools, with alerts on first‑time installations, new services, or unexpected ProgramData directories. Monitor for anomalous outbound traffic to unknown RMM infrastructure. Block consumer file‑hosting sites where possible, and enforce download restrictions on executable formats to prevent initial compromise.

New Campaign Uses Screensavers for RMM-Based Persistence

Du'aine Davis

Living off the Land: The Rise of RMM‑Driven Intrusions
Observed in the wild

• In 2025, Huntress observed a 277% year‑on‑year increase in Remote Monitoring and Management (RMM) abuse, impacting organisations across sectors. Attackers exploited trusted, often pre‑installed RMM tools to gain stealthy, persistent access, frequently leading to ransomware, with over half of suspicious activity tied to ransomware outcomes.
• Threat actors used phishing and social engineering (e.g. fake DocuSign, invoices, file shares) to trick users into installing rogue RMM agents or reused stolen RMM credentials. Rather than deploying malware, attackers leveraged legitimate RMM binaries for hands‑on‑keyboard access, lateral movement, command execution, and defence evasion, blending into normal IT activity.
• Organisations are advised to shift from trusting tool presence to verifying behaviour: baseline normal RMM usage, alert on anomalous logins, timings, users, and command execution, and maintain strict RMM inventories and fingerprints. In Microsoft Defender, focus on behavioural detections, unusual remote access patterns, suspicious command‑line activity, and attempts to disable security tooling, even when binaries are signed and approved.

RMM Abuse: When IT Convenience Bites Back | Huntress