Cybersecurity articles tagged #RMM on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/threat-actors-abuse-action1-rmm-tool-via-phishinghttps://runtimerebel.com/blog/threat-actors-abuse-action1-rmm-tool-via-phishingThreat actors are actively exploiting Action1 RMM tools, leveraging phishing emails with fake PDF invoices to deliver malicious VBS and MSI files.Tue, 06 Oct 2026 14:41:12 GMTPhishingPersistenceAction1RMMVBShttps://runtimerebel.com/blog/securing-rmm-software-8-controls-msps-must-testhttps://runtimerebel.com/blog/securing-rmm-software-8-controls-msps-must-testLearn 8 essential security controls MSPs must test when evaluating remote monitoring and management software to prevent downstream supply chain attacks.Tue, 06 Oct 2026 14:37:19 GMTSupply Chain AttackVulnerability ManagementRMMManaged Service ProvidersCVE-2026-86218https://runtimerebel.com/blog/screenconnect-client-abused-in-phishing-campaignshttps://runtimerebel.com/blog/screenconnect-client-abused-in-phishing-campaignsThreat actors are leveraging legitimate ConnectWise ScreenConnect clients in phishing campaigns to gain remote access to victim systems.Thu, 01 Oct 2026 15:07:34 GMTScreenconnectConnectwiseRMMPhishingRemote Accesshttps://runtimerebel.com/blog/microsoft-teams-abuse-the-gentlemen-ransomware-and-phaas-trendshttps://runtimerebel.com/blog/microsoft-teams-abuse-the-gentlemen-ransomware-and-phaas-trendsAnalysis of social engineering campaigns via Microsoft Teams, The Gentlemen ransomware operations, and emerging phishing-as-a-service kits.Fri, 04 Sep 2026 02:00:26 GMTMicrosoft TeamsRansomwarePhishingCredential TheftRMMhttps://runtimerebel.com/blog/cve-2026-48558-simplehelp-oidc-authentication-bypass-malwarehttps://runtimerebel.com/blog/cve-2026-48558-simplehelp-oidc-authentication-bypass-malwareThreat actors are actively exploiting CVE-2026-48558, a critical SimpleHelp OpenID Connect authentication bypass vulnerability, to deploy TaskWeaver and Djinn Stealer…Tue, 30 Jun 2026 12:48:54 GMTCVE-2026-48558SimpleHelpTaskWeaverDjinn StealerAuthentication BypassOIDCRMMhttps://runtimerebel.com/blog/whatsapp-vbscript-campaign-installs-manageengine-rmm-technical-guidehttps://runtimerebel.com/blog/whatsapp-vbscript-campaign-installs-manageengine-rmm-technical-guideAttackers are targeting WhatsApp Desktop users with malicious VBScripts to install ManageEngine RMM, enabling unauthorized remote access and control.Tue, 23 Jun 2026 09:18:25 GMTWhatsAppVBScriptManageEngineRMMRemote AccessSocial Engineeringhttps://runtimerebel.com/blog/unc3753-targets-us-law-firms-with-vishing-physical-intrusionshttps://runtimerebel.com/blog/unc3753-targets-us-law-firms-with-vishing-physical-intrusionsUNC3753 (Luna Moth) leverages vishing and physical office intrusions to steal sensitive data from US law firms and professional services, leading to swift extortion.Fri, 05 Jun 2026 16:59:08 GMTUNC3753Luna MothSilent Ransom GroupVishingSocial EngineeringData TheftExtortionLaw FirmsPhysical IntrusionRMMWinSCPRclonehttps://runtimerebel.com/blog/stealthy-phishing-abuses-connectwise-screenconnect-anydesk-rmmhttps://runtimerebel.com/blog/stealthy-phishing-abuses-connectwise-screenconnect-anydesk-rmmAttackers leverage legitimate RMM tools like ConnectWise ScreenConnect and AnyDesk in a sophisticated phishing campaign, impacting over 80 organizations and evading…Tue, 05 May 2026 00:47:28 GMTRMMPhishingConnectWise ScreenConnectAnyDeskEvasionThreat Campaign