Allow One Remote Support Tool and Block the Rest

Briefing

On October 13, 2026, Cofense described a phishing campaign that sends a generic "You are cordially invited" email. The link leads to a fake invitation page, then a CAPTCHA page meant to make the site look legitimate, then a zip file containing a ConnectWise ScreenConnect installer. Once installed, the attacker has a working remote control session on the PC.

The installer is legitimate software, which is the point. Antivirus products are slow to flag a signed remote support tool, and an attacker using one looks a lot like a technician. We saw the same approach decades ago with remote maintenance access on phone systems: the tool was real, and the problem was who held the other end.

The control that works is simple. Your business should use one approved remote support tool, connected to accounts you control, and every other remote access product should be blocked from installing or running.

What to do

Name your approved remote support tool in writing. For our clients, remote support runs through Ares RMM.
Block installation and execution of other remote access tools through application control on managed PCs.
Remove local administrator rights from daily user accounts so a downloaded installer cannot add a service.
Tell staff that IT will never ask them to install software from an email link, and give them one phone number to call to check.
Report suspicious invitations to your IT provider rather than deleting them, so the sender and links can be blocked for everyone.

How to verify

Search your RMM software inventory for remote access products other than the approved one.
On a test PC, try to run an unapproved remote access installer and confirm it is blocked.
Confirm that no daily user account is a member of the local Administrators group.
Call the IT verification number from a staff phone and confirm it is answered.

Sources

Questions about your phones, network or IT? Contact Texwan.