The cybersecurity landscape has reached a complex inflection point, moving far beyond the era of crude, easily recognizable phishing emails and stolen passwords. According to recent threat intelligence reports from cybersecurity firms Fortra and Barracuda, contemporary threat actors are fundamentally shifting their strategies. Rather than relying solely on brute-force exploitation or custom-built malware, sophisticated attackers are increasingly weaponizing tools and technologies that organizations and individuals already trust.
This dual-pronged evolution targets the foundational layers of modern digital operations: legitimate Remote Monitoring and Management (RMM) software and artificial intelligence (AI) email assistants.
On one front, cybercriminals are orchestrating intricate social engineering schemes that trick victims into installing legitimate remote desktop applications—most notably AnyDesk—under the guise of resolving a banking emergency. Once installed, these tools grant attackers persistent, real-time access to a victim’s device, bypassing traditional perimeter defenses because the software itself is authorized and benign. Fortra’s telemetry reveals a staggering 475% surge in phishing campaigns incorporating RMM tools during the first nine months of 2026 compared to the entirety of 2025, with North American financial institutions serving as the primary targets.
On the complementary front, Barracuda’s research uncovers a novel attack vector aimed directly at the modern corporate workflow: indirect prompt injection via AI email assistants. As organizations integrate generative AI to summarize, parse, and triage heavy volumes of incoming communications, attackers are embedding invisible instructions within phishing emails. These hidden directives—concealed in zero-font text, invisible styling, or the underlying HTML structure—attempt to manipulate the AI’s output. By tricking an AI assistant into labeling a fraudulent invoice or malicious lure as "legitimate" or "urgent," adversaries leverage the authority of AI summaries to bypass human skepticism.
Together, these findings underscore a systemic vulnerability in the modern enterprise. Security teams can no longer rely solely on perimeter defenses or static indicators of compromise. Protecting the digital workspace now requires a holistic, post-delivery security posture that accounts for software lifecycle management, behavioral monitoring, and the strict isolation of automated AI processing from trusted instructional inputs.
Detailed Chronology: The Evolution of RMM and AI-Targeted Phishing Campaigns
The Rise and Adaptation of RMM-Driven Phishing (2025–2026)
The convergence of remote management tools and social engineering campaigns did not happen overnight; it represents a calculated adaptation by cybercriminal syndicates seeking to maximize persistence while minimizing detection footprints.
Late 2025 (Third Quarter): Security researchers at Fortra first identified a disturbing uptick in campaigns targeting U.S. financial institutions. These attacks moved away from standard credential-harvesting pages, introducing a hybrid model where victims were lured into interacting with fake customer support chats.
Early 2026 (First Quarter): The campaign hit a peak. Threat actors streamlined their infrastructure, deploying standardized, highly convincing fake banking support portals. To distribute the necessary remote management payloads, operators increasingly turned to cloud hosting services, notably leveraging Firebase-hosted phishing links to deliver AnyDesk downloads to unsuspecting users.
Mid-2026: Following coordinated notifications, AnyDesk security teams took decisive action, restricting direct application downloads originating directly from Firebase domains. This intervention disrupted the attackers’ initial delivery pipeline, leading to a temporary dip in successful deployments. However, the respite was brief. Demonstrating remarkable agility, threat operators quickly adapted by diversifying their hosting infrastructure, shifting executables to alternative cloud storage providers, and embedding download redirects within obscured webpage elements.
The Anatomy of an RMM Exploit
To understand how an RMM-based phishing attack succeeds, one must examine the psychological and technical choreography engineered by the threat actor:
The Initial Lure: The attack typically begins via an unsolicited phone call, an urgent phishing email, or a smishing (SMS phishing) text message warning the target of catastrophic financial fraud, unauthorized account suspensions, or severe security compromises on their bank account.
The Counterfeit Portal: The victim is directed to a meticulously crafted, fraudulent banking website. The site features an interactive, highly responsive customer support chat interface designed to look and feel indistinguishable from genuine corporate portals.
Client-Side Fingerprinting: Behind the scenes, the malicious webpage executes lightweight scripts that probe the visitor’s operating system and browser environment. If the target attempts to initiate a chat or flags an issue, the system dynamically serves the appropriate remote management application tailored to their device—most frequently AnyDesk.
Guided Installation: Under the guise of a technical support agent resolving the "account emergency," the attacker walks the victim through the installation process. The victim is coaxed into providing the unique connection key required to access the device.
Persistent Infiltration: Once the connection is established, the support session transitions into an unmonitored back door. Fortra notes that this grants the adversary the ability to continuously observe, record, and manipulate everything occurring on the infiltrated workstation.
Supporting Context & Metrics: Analyzing the Threat Data
The quantitative data provided by Fortra and Barracuda paint a sobering picture of an industry grappling with rapid technological change.
The Scale of RMM Abuse
The metric of a 475% year-over-year increase in RMM-integrated phishing campaigns underscores a fundamental shift in criminal methodology. Traditional malware payloads (such as custom trojans or infostealers) often trigger automated security alerts upon execution. Conversely, enterprise networks and consumer endpoints are routinely populated with authorized administrative tools designed to facilitate remote work and IT support.
Target Demographics: While retail banking users have faced significant exposure, commercial banking accounts have emerged as primary targets. Compromising a commercial banking terminal yields far higher financial payouts and opens lateral movement vectors into corporate treasury systems.
The Dual Threat of RMM: Beyond immediate financial theft, an active RMM connection permits threat actors to deploy secondary payloads, including ransomware, credential-dumping utilities, and persistent remote access Trojans (RATs). Furthermore, compromised consumer and enterprise machines can be bundled into criminal proxy networks or sold as "access-as-a-service" commodities on underground dark-web marketplaces.
The AI Attack Surface
Barracuda’s research highlights an equally alarming trend: the exploitation of cognitive vulnerabilities within generative AI email assistants. As enterprises adopt AI-driven productivity tools to summarize lengthy email threads, flag priorities, and draft responses, they inadvertently introduce a new attack surface known as Indirect Prompt Injection.
Invisible Lures: Barracuda discovered that threat actors are embedding malicious instructions into regions of an email that remain completely invisible to the human eye. This includes zero-point font sizing, transparent text overlays, and hidden HTML comment blocks.
Manipulating Summaries: While a human recipient reads a standard, seemingly benign invoice or notification, an integrated AI assistant parsing the underlying code reads and processes the hidden instructions. In documented test cases, invoice emails contained concealed mandates instructing the AI assistant to mark the message as "urgent and verified" or to modify vendor payment routing details within the AI-generated summary.
Erosion of Trust: By tricking the AI into vouching for a malicious message, attackers exploit the user’s growing reliance on automated security assessments, effectively turning the organization’s own productivity tools against its workforce.
Official Statements and Expert Analysis
The complexity of these campaigns has prompted leading threat analysts to issue urgent warnings regarding the inadequacy of traditional, perimeter-only defense strategies.
In its comprehensive threat advisory, Fortra emphasized the profound detection challenges posed by legitimate administrative software:
"Maintaining an allowlist for supported RMM tools is no longer optional, but it must be paired with strict behavioral monitoring. A security control looking solely for malicious signatures will frequently fail to flag an established administration tool, remaining blind to the unauthorized human operator commanding it from the shadows."
Fortra’s analysts further stressed the critical need for financial institutions to proactively educate their customer bases, noting that the human element remains the vital linchpin in stopping social engineering attempts before technical execution can occur.
Echoing these sentiments, Guruprasad Kenja, Threat Analyst at Barracuda, highlighted the paradigm shift required in modern email security architecture:
"Protecting the inbox is no longer enough. No single security control will stop every variation of these attacks. When threat actors can hide instructions inside invisible code designed to manipulate the very systems we use to make sense of our communications, our entire approach to message processing must evolve."
Kenja advocates for an industry-wide transition where external communications are treated strictly as untrusted data payloads rather than executable instructions.
Future Outlook & Strategic Recommendations for IT and Security Leaders
As threat actors continue to weaponize legitimate software and artificial intelligence, cybersecurity teams must adapt their defensive postures to counter these sophisticated, blended threats. Merely updating signature-based antivirus solutions or blocking known malicious domains will no longer suffice.
To effectively mitigate the risks outlined in the Fortra and Barracuda reports, IT and security leadership should implement a multi-layered defensive framework:
1. Hardening RMM Controls and Endpoint Visibility
Enforce Strict Application Allowlisting: Organizations must establish a comprehensive, verified inventory of approved remote management tools (e.g., specific versions of AnyDesk, TeamViewer, or GoToAssist). Any unauthorized RMM utility detected on endpoints must trigger immediate automated isolation and alerting.
Monitor Behavioral Anomalies: Because RMM tools are legitimate, security operations centers (SOCs) must monitor for anomalous usage patterns. Look for unexpected outgoing connections, administrative sessions initiated outside of standard IT ticketing workflows, and unusual data staging activities following a support interaction.
User Awareness and Out-of-Band Verification: Financial institutions and enterprise security teams must train employees and customers to recognize red flags in support interactions. Any unsolicited communication directing a user to download software to resolve a "banking crisis" must be verified via established, independently sourced out-of-band communication channels.
2. Securing AI Email Assistants and Message Processing Pipelines
Sanitize Incoming Content: Security gateways and AI email plugins must be configured to strip all hidden elements—including zero-font text, invisible styling attributes, and obscured HTML tags—before the content is passed to a generative AI model for summarization or analysis.
Implement Prompt Injection Filters: Deploy specialized security filters capable of detecting and neutralizing indirect prompt injection attempts within inbound textual data. AI assistants should be programmed to ignore instructional language embedded within data payloads (e.g., treating invoices and emails strictly as data to be summarized, never as commands to be obeyed).
Principle of Least Privilege for AI Agents: Limit the operational permissions granted to AI email assistants. Assistants should be barred from automatically modifying financial records, updating vendor banking details, or executing high-privilege actions without mandatory human-in-the-loop approval.
Human-in-the-Loop Validation: Require explicit, manual human verification for any sensitive administrative or financial transaction, regardless of whether an AI assistant has labeled the underlying communication as "verified," "trusted," or "urgent."
By closing the visibility gaps surrounding trusted software and securing the computational boundaries of emerging AI tools, organizations can better insulate themselves against the innovative and deceptive tactics defining the modern threat landscape.
