Screensaver Files Used to Deploy Unauthorised RMM Tools in New Phishing Campaign

Du'aine Davis

Observed in the wild

• A spearphishing campaign observed across multiple organisations delivers business‑themed Windows screensaver (.scr) files via trusted cloud hosting services. When executed, these files silently install legitimate but unauthorised remote monitoring and management (RMM) agents, enabling persistent interactive access.
• Attackers send targeted emails linking to externally hosted .scr files disguised as documents (e.g., invoices). These overlooked executable formats install RMM tools to establish command‑and‑control. The technique exploits trust in cloud services and the permissiveness of RMM software, evading reputation‑based and signature‑based controls. Attribution remains unconfirmed, but the tradecraft is scalable, repeatable, and easily adapted by multiple threat groups.
• Organisations are advised to treat .scr files as privileged executables: block execution from user‑writable paths via Microsoft Defender Application Control or AppLocker. Maintain strict allowlists for approved RMM tools, with alerts on first‑time installations, new services, or unexpected ProgramData directories. Monitor for anomalous outbound traffic to unknown RMM infrastructure. Block consumer file‑hosting sites where possible, and enforce download restrictions on executable formats to prevent initial compromise.

New Campaign Uses Screensavers for RMM-Based Persistence