The Dual Threat: How Modern Phishing Campaigns Weaponize Trusted RMM Software and Hijack Enterprise AI Assistants

Executive Overview

The cybersecurity landscape has reached a complex inflection point, defined not by the sheer volume of attacks, but by their tactical evolution. Modern threat actors are increasingly abandoning blunt-force methods in favor of exploiting tools, platforms, and automated systems that enterprises and consumers already trust implicitly.

According to recent, comprehensive threat intelligence reports released by cybersecurity leaders Fortra and Barracuda, cybercriminals are scaling up two distinct yet equally sophisticated attack vectors: the abuse of legitimate Remote Monitoring and Management (RMM) software to maintain persistent device access, and indirect prompt injections designed to weaponize corporate AI email assistants against human users.

These dual developments signal a permanent shift in the threat paradigm. Traditionally, perimeter defenses and endpoint detection systems focused heavily on identifying malicious binaries, known malware signatures, and fraudulent credentials. Today, adversaries are bypassing these traditional security gates entirely. By hijacking dual-use administrative software—such as AnyDesk—under the guise of fake banking support, attackers can quietly establish a persistent beachhead on a victim’s machine without triggering standard malware alerts.

Simultaneously, the widespread enterprise adoption of generative artificial intelligence (AI) has introduced an unprecedented attack surface. Attackers are embedding hidden, machine-readable instructions within routine phishing emails. While the human recipient sees a standard invoice or administrative notice, the underlying AI email assistant—tasked with summarizing, prioritizing, or sorting correspondence—reads the concealed directives. These hidden instructions can manipulate the AI into mischaracterizing dangerous threats as benign, urgent, or trustworthy, effectively turning an employee’s digital assistant into an unwitting social-engineering accomplice.

For corporate security operations centers (SOCs), IT teams, and compliance officers, these converging trends highlight a stark reality: securing the enterprise perimeter and guarding the inbox are no longer sufficient. Modern incident response requires deep visibility into post-delivery activity, continuous runtime analysis of software installations, and rigorous architectural hardening of workplace AI tools.

Detailed Chronology: The Anatomy of Modern Trust Exploitation

To fully comprehend the danger posed by these campaigns, security professionals must examine the step-by-step execution of both attack vectors. Far from isolated incidents, these campaigns represent highly organized, iterative engineering on the part of threat actors.

Phase 1: The Weaponization of Remote Management Software (Fortra Findings)

The deployment of RMM tools in phishing attacks is a masterclass in living off the land—or, more accurately, forcing the victim to live off the attacker’s preferred land. The lifecycle of an RMM-based financial phishing campaign typically unfolds across several calculated stages:

1. Initial Contact & Social Engineering: The attack frequently begins outside the traditional email gateway through smishing (SMS phishing), vishing (voice phishing), or targeted spear-phishing emails. Victims receive urgent warnings regarding critical anomalies, security breaches, or compliance holds on their commercial banking or financial accounts.
2. The Counterfeit Support Infrastructure: Victims are directed to highly polished, fraudulent banking support portals. These websites mimic the branding and user interface of legitimate North American financial institutions and feature interactive customer support chat widgets.
3. Automated Environment Profiling: Once a visitor navigates to the rogue support page, automated backend scripts execute code to profile the victim’s operating system and browser environment in real time.
4. Targeted Delivery: Based on the environmental scan, the page serves up an automated download prompt for a legitimate remote management application tailored to the victim’s OS—with AnyDesk emerging as the overwhelmingly favored tool in observed campaigns.
5. Assisted Installation: Operating under the psychological pressure of a manufactured banking crisis, the victim is coached—either by an interactive chatbot script or a live scammer on the phone—to download, install, and execute the RMM software.
6. Persistence and Takeover: The victim is prompted to provide the unique connection key generated by the software. Once entered, the attacker gains unrestricted graphical user interface (GUI) access to the local machine. What began as a supposed customer service interaction transforms into a continuous, real-time surveillance session.

The operational flexibility this grants attackers is profound. Rather than relying on custom Remote Access Trojans (RATs) that are easily flagged by Endpoint Detection and Response (EDR) solutions, adversaries use legitimate utilities signed by trusted software developers. Security controls evaluating the application itself often register only a standard administrative tool, remaining completely blind to the unauthorized human operating behind the screen.

Phase 2: Indirect Prompt Injection and AI Manipulation (Barracuda Findings)

While Fortra’s research highlights physical and operational persistence on endpoints, Barracuda’s threat analysis exposes a silent, software-level assault occurring inside the modern corporate inbox. As organizations integrate generative AI assistants to manage high-volume email workflows, attackers have devised methods to subvert these cognitive helpers via indirect prompt injection.

1. Crafting the Dual-Layer Message: An attacker crafts an email containing a standard social-engineering lure—such as a routine vendor invoice or a request for a wire transfer update—tailored to deceive human readers.
2. Hiding Machine-Readable Payload: Within the underlying Hypertext Markup Language (HTML) source code, metadata fields, or via zero-width characters and invisible font formatting, the attacker embeds malicious text instructions targeted specifically at Large Language Models (LLMs).
3. AI Ingestion and Processing: When the email arrives in an enterprise environment equipped with an AI email assistant, the assistant parses the entire message body—including the hidden code—to generate a summary or risk assessment for the user.
4. Behavioral Subversion: The hidden instructions command the AI assistant to alter its analytical output. For instance, an adversarial payload might instruct the LLM to categorize a dangerous credential-harvesting link as "verified," label a fraudulent payment update as "urgent and approved," or omit warning flags entirely from the generated summary.
5. Human Exploitation via Trusted Output: Believing the AI assistant has vetted the communication, the employee interacts with the malicious email, confident that an automated safety check has already validated its legitimacy.

Supporting Context & Metrics: Quantifying the Shift

The statistical data underpinning these reports illustrate a rapid acceleration in the sophistication and scale of these campaigns. Security researchers are not merely observing theoretical vulnerabilities; they are tracking concrete, aggressive surges in operational deployment.

The RMM Phishing Surge

According to telemetry data released by Fortra, the exploitation of remote monitoring and management tools within credential-harvesting and financial phishing frameworks has skyrocketed. During the first nine months of 2026, Fortra recorded a staggering 475% increase in RMM-integrated phishing attacks compared to the total volume observed across the entirety of 2025.

Geographic and sectoral targeting data reveal a hyper-focus on North American financial institutions, with commercial banking accounts representing a primary vector of interest. This concentration stems from the high financial yield associated with successful commercial account takeovers, which allow fraudsters to initiate high-value wire transfers and corporate-level financial fraud.

The resilience of these threat actors is further demonstrated by their adaptability. When Fortra and security researchers initially tracked the peak of these campaigns in the first quarter of 2026, attackers heavily relied on standardized fake banking support pages coupled with Firebase-hosted phishing links to distribute AnyDesk executables.

Upon notification of this abuse, AnyDesk implemented strict restrictions against direct downloads originating from Firebase domains. While this defensive intervention successfully choked off the initial distribution pipeline, the threat groups quickly adapted. Operators pivoted to alternative hosting providers, obfuscated their download mechanisms, and began concealing redirects deep within embedded webpage elements to maintain their operational tempo.

The Attack Surface Expansion

Barracuda’s findings contextualize the parallel evolution of email threats. As organizations deploy advanced email gateways (SEG) equipped with natural language processing and machine learning to filter out traditional phishing lures, attackers have been forced to target the downstream cognitive layers of the organization.

By targeting both the human employee and the integrated AI assistant simultaneously, threat actors effectively exploit the trust loop. Employees trained to rely on automated productivity assistants are inherently more vulnerable when those very assistants are manipulated into providing false reassurance. The metrics gathered by threat analysts indicate that indirect prompt injections are transitioning from academic proofs-of-concept into commoditized elements of active, multi-stage phishing campaigns.

Official Statements and Industry Insights

The convergence of endpoint tool abuse and cognitive manipulation has drawn sharp commentary from leading cybersecurity analysts and threat intelligence experts who are tracking these campaigns on the front lines.

Guruprasad Kenja, threat analyst at Barracuda, underscored the fundamental shift required in modern defensive postures:

"Protecting the inbox is no longer enough. No single security control will stop every variation of these attacks. When attackers can manipulate both the human recipient and the AI assistant reviewing the message through the same email, traditional perimeter defenses are fundamentally bypassed."

Kenja’s analysis points to an uncomfortable truth for enterprise security architects: security tools designed in previous decades cannot cope with multi-modal attacks that blend social engineering, legitimate software abuse, and machine-readable prompt injections.

Similarly, threat researchers at Fortra emphasized the severe limitations of signature-based detection when dealing with dual-use administrative software:

"Maintaining an allowlist for supported RMM tools is critical, but it must be paired with aggressive behavioral monitoring and strict controls over unauthorized installations. Attackers are banking on the fact that an enterprise security tool will see a trusted administrative utility like AnyDesk and lower its guard, failing to recognize the unauthorized human operating behind the interface."

The consensus among industry leaders is clear: mitigating these threats requires a transition from static signature matching to dynamic, context-aware security frameworks that scrutinize not just what an application is, but who is commanding it and how downstream systems process its data.

Future Outlook and Strategic Recommendations

As threat actors continue to refine their methodologies, IT and security teams must evolve their defensive strategies to address the post-delivery and cognitive threat surfaces highlighted by Fortra and Barracuda. Passive defense is no longer a viable security posture.

Hardening Against RMM Abuse

Organizations—particularly within the financial sector and other high-value industries—must implement stringent controls regarding remote management software:

• Strict RMM Allowlisting: Enterprises should explicitly define an authorized inventory of RMM tools permitted within the environment. All unauthorized remote administration binaries should be blocked at the endpoint level via application control policies.
• Behavioral and Contextual Monitoring: Security teams must deploy EDR solutions configured to alert on anomalous RMM usage patterns, such as an administrative tool being executed immediately following a browser session from an external IP or in response to an unverified support interaction.
• Customer and Employee Education: Financial institutions must proactively educate clients and staff regarding the tactics used by scammers—specifically emphasizing that legitimate bank support representatives will never direct customers to download external remote management software via unverified chat widgets.

Mitigating AI Prompt Injection Risks

As generative AI assistants become permanent fixtures in the enterprise productivity stack, securing their operational integrity is paramount:

• Sanitization Before Processing: Organizations must implement rigorous input-sanitization pipelines that strip hidden content, zero-width characters, and invisible HTML code before an email or document is ingested by an AI assistant for summarization or analysis.
• Principle of Least Privilege for AI: AI assistants should operate under strict permission boundaries. They must be restricted from independently altering financial records, updating vendor payment details, or classifying high-risk communications without explicit human verification.
• Treat External Data as Data, Not Instructions: Security frameworks must train and configure AI models to treat external communications strictly as data to be analyzed, rather than executable instructions to be obeyed. Guardrails must be established to prevent LLMs from acting upon embedded commands found within the body of an unverified email.

Conclusion

The findings from Fortra and Barracuda serve as a definitive wake-up call for the cybersecurity industry. Phishing is no longer simply about tricking a user into clicking a malicious link or surrendering a password. It has evolved into a holistic discipline of systemic exploitation—leveraging trusted administrative tools to establish silent, persistent control over endpoints, and weaponizing corporate AI assistants to undermine human vigilance from within.

To survive this next generation of threats, organizations must abandon siloed security models. Securing the modern enterprise requires an integrated defense strategy that vigilantly monitors endpoint behavior, hardens internal AI workflows, and recognizes that trust—whether placed in software or artificial intelligence—is the ultimate attack vector.