The threat landscape of enterprise and consumer cybersecurity is undergoing a radical transformation, shifting away from brute-force credential stuffing toward sophisticated campaigns that hijack tools built for trust and operational efficiency. According to two landmark threat intelligence reports released by cybersecurity leaders Fortra and Barracuda, modern phishing operators are aggressively weaponizing legitimate Remote Monitoring and Management (RMM) software and launching novel "indirect prompt injection" attacks against AI-powered email assistants.
Rather than merely stealing a password to compromise an account, contemporary threat actors are orchestrating multi-stage persistence operations. By masquerading as legitimate customer support agents, cybercriminals manipulate victims into downloading and configuring trusted administration applications—such as AnyDesk—transforming a standard fraud scheme into long-term, covert device access. Concurrently, attackers are embedding hidden, machine-readable instructions within phishing emails designed to subvert AI email summaries, tricking automated assistants into misrepresenting malicious correspondence as legitimate or urgent tasks.
These findings highlight a profound paradigm shift for corporate IT and security operations centers (SOCs). Traditional perimeter defenses and static email filters are proving insufficient against threats that leverage trusted binaries and dual-target human-AI workflows. As threat actors rapidly adapt to mitigation efforts—pivoting hosting infrastructure when blocked and exploiting the blind spots of automated processing—organizations must fundamentally re-engineer their defense-in-depth strategies. Protecting the modern digital workspace now requires looking far beyond the initial inbox delivery to inspect post-delivery behavior, manage administrative software usage, and treat external data streams as untrusted instructions.
Detailed Chronology: The Anatomy of Modern RMM Phishing Campaigns
To understand how modern adversaries have weaponized administrative tools, security researchers at Fortra mapped the trajectory of targeted financial sector campaigns that surged dramatically through late 2025 and 2026. The lifecycle of these operations reveals a calculated progression from initial social engineering to persistent, deep-system compromise.
Phase 1: The Phishing Lure and Simulated Support Infrastructure
The attack typically initiates through an unsolicited communication channel—a phone call, SMS text message, or high-urgency email—alerting the target to a critical, catastrophic issue concerning their financial accounts. Designed to induce panic, the communication directs the victim to a counterfeit banking portal meticulously engineered to mimic authentic institutional websites.
Embedded within these fraudulent pages is a fully interactive, fake customer support chat interface. Behind the curtain, the web infrastructure dynamically profiles the visitor, assessing their operating system and browser environment to deliver a tailored exploitation vector. When the unsuspecting target engages with the chat to resolve their simulated account emergency, the system prompts them to download a specific remote management utility—most frequently the legitimate administrative software, AnyDesk.
Phase 2: Social Engineering and Forced Installation
Once the application is downloaded, the threat actor abandons automated delivery and assumes a hands-on role. Through the chat interface or an accompanying telephone call, the attacker guides the victim step-by-step through the installation process.
Crucially, the attacker prompts the user to generate and provide the unique connection key required to access the machine. By securing this token, the interaction transitions from a temporary, transactional customer service session into a continuous, covert surveillance channel. Fortra notes that this technique grants the adversary the ability to watch everything occurring on the infiltrated device in real-time.
Phase 3: Post-Exploitation, Persistence, and Evasion
The downstream consequences of a successful RMM deployment extend far beyond initial financial fraud. Once inside the perimeter of the target device, threat actors can:
Harvest cached credentials, multi-factor authentication tokens, and personal identifying information (PII).
Deploy secondary payloads, including ransomware, information stealers, or supplementary command-and-control (C2) agents.
Pivot internally to adjacent systems within a corporate network if the compromised machine belongs to an enterprise user.
Package and sell access to the compromised workstation on dark web criminal marketplaces.
Detecting this activity presents a severe challenge for standard endpoint protection platforms (EPPs) and Endpoint Detection and Response (EDR) solutions. Because tools like AnyDesk are signed, legitimate software utilized daily by enterprise IT departments, automated security controls frequently whitelist the application. They register the binary as a trusted administrative tool, completely blind to the fact that an unauthorized, malicious operator is wielding the controls.
Phase 4: Infrastructure Adaptation and Whac-A-Mole Defense
Fortra first identified these campaigns targeting U.S. financial institutions during the third quarter of 2025, with activity culminating in a massive volume spike through the first quarter of 2026. During this peak period, operators relied heavily on standardized fake banking support landing pages and Firebase-hosted phishing links to distribute AnyDesk executables.
In response to these findings, AnyDesk took decisive action, restricting direct downloads originating from Firebase domains. While this disruption temporarily suppressed the velocity of new attacks, threat actors rapidly adapted. Operators decentralized their hosting architecture, distributing malicious executables across alternative cloud storage platforms, experimenting with diverse hosting providers, and concealing download redirects deep inside obfuscated web page elements.
Supporting Context & Metrics: The Scale of the Threat
The quantitative data released by cybersecurity researchers underscore an alarming acceleration in the weaponization of enterprise tools.
The RMM Explosion
According to Fortra’s operational metrics, security telemetry recorded a staggering 475% increase in phishing attacks incorporating remote monitoring and management (RMM) tools during the first nine months of 2026 compared to the entirety of 2025. These campaigns have demonstrated a hyper-focus on North American financial institutions, with threat actors expressing a distinct preference for commercial banking accounts where single-compromise yields can translate into high-value corporate fund transfers.
The Convergence of Human and AI Targeting
Parallel research published by Barracuda highlights a simultaneous expansion into automated productivity layers. As enterprises rapidly adopt AI-driven email assistants to summarize long threads, categorize incoming mail, and accelerate workflow efficiency, adversaries have weaponized this exact technology.
Barracuda’s analysis revealed that attackers are embedding concealed instructions within the invisible text and underlying HTML code of standard phishing emails. While a human reader may skim the email and notice standard phishing indicators, an AI assistant processing the raw text code reads the hidden injection strings directly.
In one documented case analyzed by Barracuda, an invoice phishing email contained invisible instructions commanding the AI assistant to append an urgent, fraudulent request to modify a vendor’s payment routing details directly into the automated summary provided to the user. By manufacturing a false sense of security or urgency from what appears to be an AI-vetted summary, attackers bypass psychological skepticism and exploit the inherent trust users place in machine-generated summaries.
Official Statements and Industry Insights
The convergence of human manipulation, administrative tool abuse, and artificial intelligence exploitation has forced cybersecurity leaders to issue stark warnings regarding the obsolescence of traditional perimeter security models.
"Phishing attacks are increasingly their use of legitimate remote management software to take over computers and hidden instructions to manipulate AI e-mail assistants."
— Fortra & Barracuda Joint Threat Intelligence Findings
Guruprasad Kenja, a threat analyst at Barracuda, emphasized the fundamental breakdown of legacy defense mechanisms in an era of automated assistants:
"Protecting the inbox is no longer enough. No single security control will stop every variation of these attacks."
Highlighting the unique challenge posed by dual-target attacks—where both the human recipient and the AI processor are targeted simultaneously—Kenja stressed that external communications can no longer be trusted as passive data streams. Instead, organizations must treat incoming mail as hostile instruction sets until rigorously validated.
Future Outlook and Strategic Recommendations
As cybercriminals continue to innovate by subverting the very tools built to empower remote workers and streamline digital communication, IT and security leaders must overhaul their defense strategies. Mitigating these advanced vectors requires a multi-layered approach that addresses both administrative software governance and AI security.
1. Hardening Remote Management Infrastructure
Strict Application Whitelisting and Allowlisting: Organizations must abandon generic monitoring in favor of strict allowlists for approved RMM tools. Unrecognized remote management binaries should trigger immediate automated blocking and high-priority alerts.
Network-Level Behavioral Monitoring: Security teams must monitor outbound connections initiated by administrative tools to detect anomalous command-and-control channels or unauthorized external sessions.
Consumer Education and Fraud Awareness: Financial institutions and enterprise security teams must collaborate to educate users regarding the tactics of fake support interactions, emphasizing that legitimate banking support will never initiate unsolicited remote desktop control.
2. Securing AI Email Assistants and Automated Workflows
Sanitization of Incoming Content: Security gateways must strip hidden text, embedded HTML tags, and zero-width characters before passing email content to downstream AI processing models.
Prompt Injection Detection: Deploy specialized security filters designed to recognize and neutralize indirect prompt injection attempts embedded within email bodies.
Principle of Least Privilege for AI: Limit the operational permissions granted to AI email assistants. Assistants should be barred from autonomously altering financial records, updating vendor banking details, or executing high-privilege commands without explicit human verification.
Mandatory Human-in-the-Loop Approvals: Enforce strict policy gates requiring manual human authorization for any sensitive operational action suggested or summarized by AI assistants. External messages must remain raw data to be analyzed, never autonomous instructions to be obeyed.
Ultimately, the findings from Fortra and Barracuda serve as a clarion call for the cybersecurity industry. As adversaries blur the lines between legitimate software, social engineering, and machine learning exploitation, security architectures must evolve to secure the entire lifecycle of digital communication—from the initial inbox delivery to the deepest automated layers of the enterprise workstation.
