A threat actor is distributing signed malware that impersonates legitimate workplace applications to gain initial access, then deploys Remote Monitoring and Management (RMM) software as a persistent backdoor. The article does not provide a CVSS score, specific affected software versions, fixed versions, or a workaround.
2026-03-03 (Back to Inventory) Signed malware impersonating workplace apps deploys RMM backdoors Author(s): Microsoft Organization: Microsoft win.trustconnect Open article directly Related Articles 2026-02-24 ⋅ Microsoft ⋅ Microsoft Defender Experts Developer-targeting campaign using malicious Next.js repositories 2026-01-14 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Inside RedVDS: How a single virtual desktop provider fueled worldwide cybercriminal operations 2025-10-09 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Investigating targeted “payroll pirate” attacks affecting US universities Storm-2657