Phishing with remote-management tools: check who installed the agent
Understand why a legitimate RMM program can still provide unauthorized access, and inventory its installation and account connections.
In brief
Microsoft’s 29 September 2026 report describes phishing that abuses remote monitoring and management tools. The tool can be legitimate while the person installing or controlling it is not authorized.
The defensive question is who approved the installation, which organization controls it and whether that matches the device’s support arrangement.
Check the owner behind the tool
For a work device, ask the administrator whether the agent and controlling tenant belong to the organization. Compare installation timing with the support ticket. A valid signature explains who made the software, not who is controlling this deployment.
Verify the request before installation
Do not install an agent because an urgent message says IT needs it. Use a known helpdesk route and confirm the task. Reject requests to reveal account codes or disable protection as part of an unsolicited session.
If the installation is unexplained
Stop sensitive work and follow the responsible incident process. Preserve the relevant message and time, and let competent responders assess services, sessions and credentials. Deleting one installer file does not remove a persistent agent or explain what access occurred.
Before you act
Finding an RMM agent alone does not prove compromise. Removing an organization’s legitimate management software blindly can break support and destroy useful incident context.
What to do next
- Inspect the installed agent, its installation time and the authorized support owner.
- Verify the claimed support request through an existing independent channel.
- Escalate an unexplained agent or session to the responsible security team, preserving evidence and restricting exposure appropriately.
