A vague email lands in the inbox: “You are cordially invited.” No organizer you recognize. No venue. No date that survives a quick search. The button says something like “Download the Invite.” A CAPTCHA appears on a domain that is a few weeks old. A second page still has no address. Then a zip file unpacks an installer for a legitimate remote-support product.
The taskbar gets a quiet icon. Someone else gets a live channel into the workstation.
In mid-October 2026 reporting from a major phishing defense team described exactly this holiday-season pattern: RSVP-themed lures that end in a commercial remote monitoring and management (RMM) client used as a remote access trojan. Public advisories from state cyber centers and other researchers have described the same family of campaigns for more than a year. The binary is often a real product. The tenant behind it is not your help desk.
If you run a dental office, law firm, clinic, or small financial shop, this matters more than another fake Microsoft 365 login screenshot in awareness training. Your staff already know not to open a random `.exe` from a stranger. They are less ready for a webpage that feels like event planning and an installer that antivirus may treat as ordinary support software.
Why abusing real remote support keeps working
Attackers figured out that signed remote-support clients travel farther than custom malware. Many endpoint products are trained to trust the brand. Many users are trained to trust anything that survived a CAPTCHA. Many offices already allow help-desk tools, so a new tray icon does not look alien.
The business process is the malware. The installer is just a customer of a remote-support vendor until someone notices the tenant ID, the parent process, or the fact that nobody opened a ticket.
Secure email gateways help. They are not a personality. Socially engineered paths still arrive in environments that already pay for filtering. “We have a SEG” is not the same sentence as “users cannot install remote support from Downloads.”
The kill chain in plain English
- Email with invitation language and a download button.
- Redirect to a CAPTCHA on a young, unbranded domain.
- Second fake invite page that still refuses to name a place or time.
- Zip labeled like a party invite, containing a remote-support client setup binary.
- Install creates a service and a tray icon. The attacker session is live.
Hash-based blocking helps for one exact binary. It does not save you from the next build under a fresh tenant. Detect the behavior: unexpected remote-support installs on endpoints that are not help-desk jump boxes.
What defenders in a small office should do
Application control first. Allow remote-support and RMM clients only from IT-managed packages and known tenant IDs. A user-initiated client setup from a Downloads zip should hard-fail. If your current stack cannot do that, put it on the next security purchase list ahead of another awareness video.
Endpoint alerts that match the story. Alert when a remote-support service appears outside a change window. Alert when the parent process is a browser, email client, or archive tool unpacking something that looks like an invite. Alert when a workstation that never had a help-desk session starts talking to remote-support relay infrastructure.
Email rules that weight the bait. Quarantine inbound messages that combine RSVP or “cordially invited” language with generic download buttons when the sending domain fails authentication or is brand-new. DMARC on your own domains still matters: it stops easy spoofs of your partners’ real addresses. It will not stop a criminal-owned festive domain that authenticates correctly for itself.
Make reporting faster than downloading. The report-phishing button has to be easier than the invite button. People still catch what gateways miss. Do not shame curiosity. Shame a process that lets ClientSetup run from Downloads without a ticket.
Helpdesk script that does not insult people. Real invites come from people you know, on domains you can call, with dates and addresses that exist. Corporate events go through calendar tools IT already approved. Nobody legitimate needs a CAPTCHA on a three-week-old domain to show you a dinner PDF. If the invite is real, the host can resend through a normal channel after one boring question.
If someone already clicked
Disconnect the network interface. Preserve the machine if the data on it matters for investigation. Remove the unauthorized remote-support client from a clean process. Rotate credentials from a known-good device. Assume anything reachable from that session is scorched until you prove otherwise. Changing a password while still sitting on the infected laptop is theater.
Then ask the uncomfortable inventory question: how many other endpoints have the same remote-support product installed without a ticket?
How this fits managed security for professional firms
Dark Edge Consulting builds endpoint and email controls that treat unexpected remote access tools as incidents, not curiosities. Continuous monitoring and alerting, allow-listing for support tooling, and a short response playbook beat another cartoon training module.
We will not promise that no lure ever lands. We will help you make “someone installed remote support from a party zip” show up as a high-priority alert with a clear next step. For MSPs evaluating how we handle client-scoped remote access ourselves, we would rather walk through a live session and show the record left behind than hand you a brochure.
Adapted from a post by Andrew Trainum on Cybersecsloth.
—
Want to review which remote access tools are allowed in your office? Book a strategy call.