The cybersecurity landscape is undergoing a paradigm shift. For decades, the standard threat model for email-based attacks relied heavily on credential harvesting, malicious attachments, and social engineering designed to trick unsuspecting human targets into giving up their passwords. While these foundational vectors remain prevalent, cybercriminals are increasingly adapting to modern IT infrastructures and security controls.
According to two major threat intelligence reports released by security firms Fortra and Barracuda, threat actors are aggressively pivoting toward a dual-pronged approach: weaponizing legitimate Remote Monitoring and Management (RMM) software to maintain persistent access after an initial breach, and injecting hidden malicious prompts to manipulate artificial intelligence (AI) email assistants deployed in enterprise environments.
These sophisticated strategies underscore a sobering reality for Chief Information Security Officers (CISOs), IT administrators, and security operations centers (SOCs): defending the corporate perimeter or simply flagging traditional phishing links is no longer sufficient. Modern attackers are leveraging the very tools organizations trust—administrative software designed to streamline IT support and AI systems intended to boost productivity—against them.
The findings reveal that threat actors are no longer just looking to breach a network; they are engineering attacks that survive post-delivery analysis, exploit blind spots in standard endpoint detection, and subvert automated processing systems. This report provides an in-depth examination of these evolving vectors, tracing their mechanics, analyzing the threat metrics, evaluating industry responses, and offering a strategic outlook on how organizations must adapt their defensive postures to counter this new wave of cyberthreats.
Detailed Chronology of Emerging Tactics
The convergence of RMM exploitation and AI prompt injection represents a coordinated evolution in cybercriminal methodology. To understand how these tactics materialized, it is necessary to examine the operational mechanics and timelines documented by security researchers.
Phase 1: The Weaponization of Remote Management Software (2025–2026)
The misuse of RMM tools is not entirely new, but the scale, systematization, and focus of recent campaigns mark a dangerous escalation. Fortra’s threat intelligence division began tracking a concentrated surge in RMM-based phishing campaigns targeting North American financial institutions—specifically commercial banking accounts—in the third quarter of 2025.
Unlike traditional malware droppers that download custom Trojans or spyware, these threat actors leverage legitimate, widely used administrative software. The attack chain is meticulously engineered to blend in with normal business operations:
The Initial Hook: The attack typically begins with a multi-channel lure (phone call, email, or SMS) warning the victim of a critical, urgent issue with their bank account.
The Counterfeit Portal: Victims are directed to a convincing, counterfeit banking website featuring a live customer support chat interface.
OS Fingerprinting and Delivery: Behind the scenes, the fraudulent webpage queries the visitor’s operating system. If the target is running a compatible OS, the chat interface triggers the automated download of a remote management application. Data indicates that AnyDesk has been the primary tool abused in these campaigns.
Social Engineering the Installation: Posing as technical support agents, the attackers walk the victim through the installation process. Once installed, the victim is asked to provide the unique connection key.
Persistent Infiltration: This interaction instantly transforms a supposed customer service session into an unmonitored backdoor, allowing the attacker to continuously watch everything occurring on the compromised device, steal credentials, deploy ransomware, or sell access on underground criminal marketplaces.
During the first quarter of 2026, this activity peaked. Attackers streamlined their infrastructure by utilizing standardized fake banking support pages and leveraging Firebase-hosted phishing links to deliver AnyDesk installation binaries.
When AnyDesk was notified of this abuse, the company swiftly restricted direct downloads originating from Firebase domains. While this disruption temporarily blunted the velocity of the attacks, it highlighted the agility of modern threat groups. Operators quickly adapted by decentralizing their hosting, utilizing alternative cloud storage providers, and concealing download redirects inside deeply embedded webpage elements.
Phase 2: Subverting AI Email Assistants via Indirect Prompt Injection
While Fortra’s findings focus on endpoint persistence through RMM tools, Barracuda’s threat research sheds light on an entirely different layer of the enterprise stack: AI-driven email summaries and productivity assistants.
As organizations increasingly integrate generative AI tools into corporate email clients to summarize long message threads, prioritize inboxes, and flag urgent tasks, threat actors have found a way to weaponize these automated systems. Barracuda documented campaigns where attackers embed concealed instructions within emails—instructions that are entirely invisible to human readers but parsed by large language models (LLMs).
This technique, known as indirect prompt injection, operates on a dual-target philosophy:
The Human Lure: The email contains standard, credible social engineering text designed to look like a legitimate invoice, billing update, or corporate notice.
The Hidden Directive: Buried within zero-font text, HTML comments, or structural metadata are commands directed explicitly at the AI assistant. For example, an injected prompt might instruct the AI summarizer to override its standard safety protocols, ignore malicious indicators, or falsely classify an urgent demand to alter vendor payment details as "safe, verified, and high priority."
By manipulating the AI assistant, attackers hope to trick the human user into lowering their guard. If an employee reads a security summary generated by their own trusted corporate AI assistant stating that a message is authentic and urgent, the psychological barrier to clicking a link or transferring funds drops significantly.
Supporting Context and Metrics: The Numbers Behind the Threat
Quantifying the shift toward trusted tool abuse provides vital context for resource allocation within enterprise security budgets.
Fortra’s RMM Phishing Metrics
Data compiled by Fortra reveals a dramatic acceleration in the weaponization of remote administration software:
The 475% Surge: During the first nine months of 2026, Fortra recorded a staggering 475% increase in phishing attacks incorporating RMM tools compared to the entirety of 2025.
Sector Targeting: The primary victims of these campaigns have been North American financial institutions, with a concentrated focus on high-value commercial banking accounts.
Tool Preferences: While multiple administrative suites exist, AnyDesk emerged as the dominant vector due to its cross-platform compatibility, ease of installation, and widespread legitimate enterprise adoption.
The Detection Dilemma
The fundamental challenge highlighted by both Fortra and Barracuda is the "dual-use" nature of these technologies. Traditional endpoint detection and response (EDR) agents and security information and event management (SIEM) platforms are designed to flag known malicious signatures, unauthorized executables, or anomalous network traffic.
However, RMM software like AnyDesk, TeamViewer, and ConnectWise are standard tools installed on millions of corporate and personal devices worldwide. A security control monitoring an endpoint will frequently recognize an established, signed administrative tool without realizing that an unauthorized, malicious actor holds the connection keys on the other end of the session.
Similarly, enterprise security gateways have historically focused on scanning email bodies and attachments for malicious links, known malware signatures, and credential-harvesting forms. They were not originally architected to parse text for hidden machine-learning instructions designed to manipulate downstream AI software.
Official Statements and Industry Analysis
The implications of these reports have drawn widespread commentary from leading cybersecurity analysts, emphasizing that traditional perimeter defenses are no longer adequate.
"Phishing is no longer just about getting someone to click a link or type a password into a fake login page. Attackers are engineering complex, multi-stage operations that exploit the software we rely on for daily business operations. Protecting the inbox is simply no longer enough."
— Guruprasad Kenja, Threat Analyst at Barracuda
Security experts emphasize that these campaigns exploit a fundamental human vulnerability: the assumption of safety associated with recognized brands and internal tools. When a user sees an official RMM application downloading during what they believe is a bank support session, or reads an email summary generated by their organization’s internal AI assistant, their critical thinking is bypassed by manufactured trust.
Furthermore, industry analysts note that the rise of indirect prompt injection marks the beginning of a broader trend where attackers target not only human psychology but also the cognitive layers of enterprise software. As businesses rush to adopt generative AI to manage information overload, they inadvertently introduce a new attack surface that bypasses traditional email security filters.
Future Outlook: Securing the Post-Inbox Enterprise
Mitigating these sophisticated threats requires a fundamental realignment of enterprise security strategies. Security teams must look beyond initial email delivery and examine the entire lifecycle of an interaction, encompassing endpoint installations, human-machine interfaces, and automated processing pipelines.
Recommended Defensive Strategies for IT and Security Teams
1. Hardening RMM Deployments
Implement Strict Allowlisting: Organizations must enforce an explicit allowlist of approved RMM tools. Any unauthorized remote management software (such as unapproved instances of AnyDesk, TeamViewer, or LogMeIn) should be blocked at the network and endpoint levels.
Monitor Administrative Sessions: Security operations centers should deploy behavioral analytics to detect anomalous RMM usage, such as connections originating from unusual geographic locations, connections occurring outside standard business hours, or sessions established immediately following a phishing alert.
Customer Awareness and Education: Financial institutions and consumer-facing enterprises must actively educate their clients regarding legitimate support workflows. Users must be taught that genuine financial institutions will never initiate a support chat that automatically downloads remote administration software.
2. Defending Against AI Prompt Injection
Sanitize Input Before Processing: Enterprise AI assistants and email summarization tools must be configured to strip out hidden content—including zero-size fonts, invisible HTML tags, and metadata—before the text is parsed by the language model.
Implement Dual-Layer Validation: Treat external emails as untrusted data feeds rather than sources of direct instruction. AI assistants should be programmed to recognize and flag attempts to override system prompts or inject administrative commands.
Enforce Human-in-the-Loop Governance: Critical financial transactions, vendor payment detail changes, and system permission modifications must never be approved solely on the recommendation of an AI assistant. Mandatory human verification and multi-factor authentication loops should be enforced for all sensitive actions.
Granular Assistant Permissions: Restrict the operational scope of enterprise AI tools. Assistants should have read-only access to specific workflows and should lack the architectural privileges required to execute system-level commands or alter financial ledgers.
Conclusion
The findings from Fortra and Barracuda serve as a stark warning for the cybersecurity community. As threat actors evolve their tactics to exploit legitimate remote management utilities and manipulate enterprise AI assistants, defenders must adopt a holistic, defense-in-depth posture. By securing the endpoint against unauthorized RMM persistence and hardening AI pipelines against indirect prompt injection, organizations can better protect themselves against the next generation of cyber threats.
