The cybersecurity landscape is undergoing a structural paradigm shift. No longer content with merely stealing credentials or deploying conventional malware, modern cybercriminal syndicates are aggressively pivoting toward a more sophisticated operational model: weaponizing the very tools organizations and consumers trust the most.
According to recent, deeply concerning threat intelligence reports released by cybersecurity leaders Fortra and Barracuda, phishing operations are evolving past simple deception. Attackers are increasingly exploiting legitimate Remote Monitoring and Management (RMM) software to establish persistent, long-term access to compromised infrastructure. Simultaneously, malicious actors are launching "dual-target" attacks that manipulate not only human psychology but also the emerging infrastructure of workplace artificial intelligence—specifically, enterprise email assistants.
These developments signal an alarming maturation in cybercrime. By subverting RMM tools like AnyDesk, threat actors can bypass traditional signature-based security controls, transforming a routine helpdesk-style interaction into deep-seated device infiltration. Meanwhile, prompt-injection techniques aimed at AI tools expose a blind spot in how modern organizations process inbound communications.
For Chief Information Security Officers (CISOs), IT directors, and system administrators, these findings underline a sobering reality: perimeter security and inbox-level defenses are no longer sufficient. Securing the modern enterprise now requires total lifecycle visibility, tracking what occurs after a message is opened, analyzing software installations, and auditing how automated enterprise assistants ingest external data.
Detailed Chronology: The Anatomy of Modern RMM and AI Phishing Attacks
To fully appreciate the severity of these emerging vectors, it is vital to trace how these multi-stage attacks are engineered and executed in the wild.
Phase 1: The RMM Exploitation Vector (Fortra’s Findings)
Fortra’s telemetry highlights a staggering 475% year-over-year surge in phishing campaigns incorporating RMM tools during the first nine months of 2026, compared to the entirety of 2025. These campaigns have preferentially targeted North American financial institutions, zeroing in on commercial banking accounts where a successful breach yields high financial returns.
The Initial Bait: The attack sequence typically begins off-site via a high-urgency phone call, a persuasive phishing email, or a smishing (SMS phishing) text message warning the target of an imminent banking crisis, security suspension, or fraudulent transaction on their corporate or commercial account.
The Counterfeit Portal: Victims are directed to meticulously designed, fraudulent banking websites. These pages feature deceptive, interactive live-chat windows that mimic legitimate customer support portals.
OS Profiling and Drive-By Delivery: Behind the scenes, the malicious webpage silently inventories the visitor’s operating system. If the target engages with the chat interface, the system automatically triggers a download of the exact RMM application best suited for their environment—most commonly the legitimate administration utility AnyDesk.
Social Engineering the Installation: Posing as security or IT support, the threat actor guides the victim step-by-step through the installation process. Once installed, the victim is prompted to hand over the unique connection key.
Persistent Infiltration: This handoff converts a temporary support interaction into a persistent, covert surveillance channel. Fortra notes that attackers use this live session to continuously monitor device activity, harvest credentials, deploy secondary payloads like ransomware, or sell access rights to downstream cybercrime networks.
When AnyDesk was alerted to this abuse via Firebase-hosted domains, the company moved swiftly to restrict direct downloads from those specific endpoints. While this disrupted immediate attack chains, threat actors rapidly adapted. Cybercriminals shifted to alternative file-hosting providers and began embedding download redirects inside obscured webpage elements to bypass traditional traffic analysis.
Phase 2: Dual-Target AI Poisoning (Barracuda’s Findings)
While Fortra uncovered threats operating at the endpoint level, Barracuda’s threat intelligence division exposed a parallel front: attacks designed to simultaneously deceive human recipients and poison the AI email assistants designed to protect them.
Concealed Instructions: Barracuda analysts discovered that modern phishing campaigns frequently bundle traditional social engineering lures with hidden directives embedded within parts of the message invisible to the human eye—such as zero-font text, metadata, or underlying HTML/CSS code.
AI Prompt Injection: When an employee runs their corporate email through an integrated AI assistant to summarize or categorize inbound messages, the hidden instructions execute automatically.
Subverting Automation: In one observed vector, an ostensibly routine vendor invoice instructed the AI assistant to inject an urgent, fraudulent update regarding a change in banking payment details directly into the summary text presented to the employee.
Manipulating Engagement: By forcing the AI to mislabel malicious or fraudulent messages as "legitimate," "verified," or "high-urgency," attackers exploit the user’s growing trust in automation, effectively turning the enterprise’s own productivity tools into vectors of deception.
Supporting Context and Metrics: The Numbers Behind the Threat
The empirical data compiled by Fortra and Barracuda paint an unambiguous picture of a threat landscape under systemic transformation.
475% Surge: Fortra’s recorded increase in RMM-integrated phishing attacks during the first three quarters of 2026 compared to all of 2025 underscores a dramatic operational shift. Attackers are increasingly leaning toward "living off the land" techniques—leveraging administrative software that security teams are hesitant to outright block because it is essential for normal business operations.
Commercial Banking Focus: North American financial institutions have borne the brunt of these RMM-based assaults. Commercial banking accounts are prime targets due to high transaction limits and less friction compared to heavily audited enterprise wires.
The Firebase Pivot: Attackers initially favored Firebase-hosted links for rapid, reliable payload delivery. Even after platform-level mitigations restricted direct downloads, threat groups proved highly resilient, quickly diversifying their hosting infrastructure to maintain campaign momentum.
Dual-Layer Vulnerability: Barracuda’s analysis highlights that vector complexity is no longer linear. By targeting the intersection of human cognitive bias and machine-learning interpretation, threat actors are forcing security architects to rethink data handling across the entire communication pipeline.
Official Statements and Industry Insights
The convergence of RMM abuse and AI prompt injection has prompted cybersecurity analysts and threat researchers to issue urgent advisories for enterprise defenders.
Guruprasad Kenja, threat analyst at Barracuda, encapsulated the changing philosophy required to defend modern corporate infrastructure:
"Protecting the inbox is no longer enough. No single security control will stop every variation of these attacks."
Kenja emphasizes that as enterprises adopt large language models (LLMs) and automated productivity assistants, external communications must be treated strictly as data to be analyzed, rather than instructions to be passively obeyed. When an email contains hidden parameters directed at automated processors, the system is essentially experiencing a localized prompt injection attack.
Meanwhile, security researchers at Fortra have stressed the difficulty of identifying RMM abuse via traditional endpoint detection and response (EDR) platforms. Because utilities like AnyDesk, TeamViewer, and ConnectWise are trusted enterprise administration tools, standard telemetry often fails to differentiate between authorized IT maintenance and unauthorized third-party hijacking. Fortra notes:
"A security control looking for malicious applications may recognize an established administration tool without recognizing that an unauthorized person is using it."
Future Outlook: Securing the Enterprise of Tomorrow
As cybercriminals continuously refine their methods, IT and security leadership must adapt their defensive postures to counter these sophisticated, multi-layered vectors. Relying solely on perimeter email filters and basic endpoint blocks is a failing strategy.
Recommended Mitigations and Strategic Adjustments
Strict RMM Allowlisting and Monitoring: Organizations must inventory all remote management software authorized for use within their ecosystem. Implementing a rigorous allowlist—paired with behavioral monitoring that flags unusual RMM connection times, unexplained sessions, or unexpected administrative downloads—is critical.
Sanitizing Inbound AI Data: Enterprise applications that utilize AI email assistants must incorporate robust pre-processing filters. Hidden text, zero-pixel fonts, and anomalous metadata must be systematically stripped before an LLM ingests and summarizes message content.
Establishing Principle of Least Privilege for AI: AI assistants should be restricted from performing autonomous, high-impact actions. Any structural modification—such as altering vendor payment profiles, updating banking data, or overriding security warnings—must strictly require human-in-the-loop verification and multi-factor approval workflows.
Enhanced Customer and Employee Education: Because RMM attacks frequently begin with social engineering outside the corporate email perimeter (such as phone calls or text messages targeting bank customers or employees), organizations must train personnel and clients alike to recognize the red flags of fake support channels.
The blending of trusted system administration tools and artificial intelligence exploitation represents the next great hurdle in cybersecurity. Only by embracing comprehensive post-delivery monitoring, rigorous endpoint governance, and defensive AI architectures can modern enterprises hope to stay one step ahead of an increasingly adaptive threat landscape.
