The cybersecurity landscape is undergoing a paradigm shift. Modern cybercriminals are moving away from brute-force tactics and easily detectable malware payloads, choosing instead to weaponize the very tools designed to increase productivity and streamline administration. According to recent intelligence reports released by cybersecurity firms Fortra and Barracuda, contemporary phishing campaigns are increasingly exploiting legitimate remote monitoring and management (RMM) software to achieve persistent device access, while simultaneously embedding hidden prompt injections to manipulate AI-powered email assistants.
These dual vectors highlight an alarming sophistication in social engineering. Rather than simply tricking a victim into handing over a password, today’s attackers are engineering multi-stage workflows that bridge the gap between human error and automated systemic trust. In the financial sector, threat actors are leveraging fake customer support channels to trick victims into installing legitimate remote desktop applications like AnyDesk, transforming a single fraudulent chat session into ongoing, real-time device surveillance. Simultaneously, corporate environments face a novel breed of email-borne attacks where malicious payloads carry hidden instructions designed to trick artificial intelligence summaries into misrepresenting dangerous links or fraudulent invoices as urgent, legitimate communications.
For Chief Information Security Officers (CISOs), IT directors, and security operations center (SOC) personnel, these findings signal an urgent need to reevaluate perimeter-based defenses. Protecting the corporate inbox is no longer sufficient. Organizations must now account for post-delivery behavior, visibility blind spots created by trusted administrative software, and the integrity of automated processing layers within modern productivity suites. This comprehensive report investigates the mechanics of these evolving threats, analyzes the underlying data, examines expert commentary, and outlines actionable mitigation strategies for enterprise security teams.
Detailed Chronology of the Threat: The Rise of RMM-Driven Phishing and AI E-Mail Manipulation
The integration of remote management tools and artificial intelligence into mainstream enterprise operations has been a boon for efficiency. However, threat actors view these technologies through a different lens: as an expanding attack surface characterized by inherent trust.
Phase 1: The Weaponization of Remote Monitoring and Management (RMM) Tools
The exploitation of RMM software in credential and device-takeover phishing is not entirely new, but its scale and operational execution have accelerated dramatically. According to Fortra’s threat intelligence division, attacks incorporating RMM tools surged by a staggering 475% during the first nine months of 2026 compared to the entirety of 2025.
The campaign primarily targets North American financial institutions, with a concentrated focus on commercial banking accounts where high-value transactions are routine. The lifecycle of these attacks typically follows a meticulously planned sequence:
The Initial Hook: The attack begins externally through a telephone call, urgent phishing email, or SMS message warning the victim of a critical security breach or fraudulent activity within their bank account.
The Counterfeit Portal: Victims are directed to a professionally crafted, deceptive banking website featuring an interactive customer support chat widget.
OS Fingerprinting and Delivery: Behind the scenes, the fraudulent webpage queries the visitor’s operating system. Upon initiating a chat, the system triggers an automated download of the appropriate remote management application tailored to the victim’s device—most commonly AnyDesk.
Social Engineering the Installation: Under the guise of "resolving the security issue," the fake support agent guides the victim through the installation process and requests the connection key required for remote access.
Persistent Surveillance and Exploitation: Once the connection is established, the dynamic changes instantly. A temporary support interaction evolves into an ongoing mechanism that allows attackers to monitor everything occurring on the compromised device in real time.
The consequences of this persistent access extend far beyond the initial banking scam. Fortra notes that threat actors utilize this foothold to harvest credentials, extract personally identifiable information (PII), deploy ransomware, install secondary command-and-control (C2) frameworks, or auction device access on illicit criminal marketplaces.
Detecting these incursions presents a unique challenge for traditional security controls. Because applications like AnyDesk are legitimate utilities utilized by enterprise IT departments globally, endpoint detection and response (EDR) solutions often recognize the software as authorized, failing to flag the unauthorized human actor operating behind the console.
Phase 2: The Evolution and Adaptation of Delivery Mechanisms
Fortra first documented these targeted operations against U.S. financial institutions in the third quarter of 2025, with activity peaking in the first quarter of 2026. During this peak, operators relied heavily on standardized, highly convincing fake banking support portals coupled with Firebase-hosted phishing links to distribute AnyDesk executables.
When notified of this malicious abuse, AnyDesk took decisive action by restricting direct downloads originating from Firebase domains. While this intervention successfully suppressed the immediate wave of attacks, threat actors proved resilient. Operators quickly adapted by decentralizing their hosting infrastructure, shifting executables to alternative cloud storage and content delivery networks, and experimenting with diverse hosting providers. Furthermore, they began concealing download redirects within embedded webpage elements to evade automated URL inspection tools.
Phase 3: Exploiting the Automated Inbox via AI Prompt Injection
While financial sector targets face RMM-based device compromises, corporate email environments are confronting an entirely different class of social engineering: AI-targeted prompt injection. Barracuda’s threat intelligence highlights a growing trend where attackers target both the human recipient and their integrated AI email assistant within a single message.
Modern corporate email clients frequently utilize AI assistants to summarize long threads, highlight key action items, and categorize message urgency. Attackers are exploiting this architectural feature by embedding hidden instructions within parts of the email that are invisible to human readers—such as zero-font text, layered metadata, or background HTML code.
In one documented scenario, a fraudulent invoice email sent to an accounting department contained a standard phishing lure visible to the human reader, while the hidden metadata commanded the AI assistant to append an urgent, unauthorized request to modify a vendor’s banking and payment details directly into the summary output.
By manipulating the AI assistant into endorsing the message or manufacturing a false sense of urgency, attackers hope to bypass the employee’s natural skepticism, effectively turning the organization’s own productivity tools against them.
Supporting Context and Metrics: Quantifying the Shift in Cyberthreat Tactics
To fully grasp the gravity of these reports, security leaders must analyze the quantitative data driving these trends. The convergence of social engineering with enterprise-grade utility software represents a fundamental maturation of cybercriminal operations.
The RMM Surge in Numbers
475% Increase: The dramatic multiplier reported by Fortra regarding RMM-integrated phishing attacks comparing the first three quarters of 2026 to the full year of 2025.
Primary Target Vector: Commercial banking and financial services sectors in North America remain the primary focal points due to the high-yield nature of successful account takeovers.
Dominant Utility: AnyDesk has emerged as a primary instrument of choice for threat actors due to its cross-platform compatibility, ease of installation, and widespread legitimacy among enterprise users.
The Expanding Attack Surface of AI Assistants
As organizations rapidly adopt generative AI and large language models (LLMs) to manage email overload, they inadvertently introduce new vulnerability vectors. Barracuda’s findings underscore that traditional secure email gateways (SEGs) designed to filter out malicious links and known malware attachments are blind to semantic manipulations.
When an email arrives bearing dual messages—one targeted at human psychology and another targeting machine processing—it exposes a critical gap in defense-in-depth strategies. Attackers recognize that while an employee might spot a suspicious invoice, an AI summary that vouches for the message’s legitimacy or manufactures artificial urgency can heavily influence final decision-making.
Official Statements and Expert Analysis
Security researchers and industry analysts have issued strong warnings regarding the structural changes required to combat these sophisticated campaigns.
Fortra on RMM Exploitation
In its official guidance, Fortra emphasized the necessity of tightening controls around remote management software.
"Maintaining an allowlist for supported RMM tools is no longer optional; it is a foundational requirement for modern endpoint security," security analysts noted in the report.
Furthermore, Fortra stressed that technical controls must be paired with customer-facing education, particularly within the financial sector, urging institutions to actively train clients and account holders to recognize the hallmarks of counterfeit support interactions and unauthorized chat-based directives.
Barracuda on the Limits of Inbox Protection
Guruprasad Kenja, threat analyst at Barracuda, underscored the changing reality of enterprise defense in his analysis:
"Protecting the inbox is no longer enough. No single security control will stop every variation of these attacks."
Kenja pointed out that as long as email systems treat incoming communications as a mix of human-readable text and executable data for automated processors, attackers will find ways to exploit the seams between human intuition and machine automation.
Future Outlook: Strategic Recommendations for IT and Security Leaders
As cybercriminals continue to innovate by blending legitimate software misuse with artificial intelligence manipulation, enterprise security architectures must evolve. To defend against these multi-layered threats, IT and security teams should implement a comprehensive, defense-in-depth framework encompassing the following strategic pillars:
1. Hardening RMM Management and Endpoint Governance
Implement Strict Allowlisting: Inventory all remote monitoring and management tools operating within the corporate network. Enforce strict allowlists and block unauthorized RMM executables (such as AnyDesk, TeamViewer, and LogMeIn) at the endpoint level.
Behavioral EDR Monitoring: Configure EDR solutions to flag anomalies associated with RMM sessions, such as unexpected external connections initiated immediately following interactions with unverified web chats or support portals.
Privileged Access Management (PAM): Restrict standard users from installing unvetted software by removing local administrator privileges, ensuring that any installation of remote management utilities requires explicit IT authorization.
2. Securing the AI Email Pipeline
Sanitize External Content: Implement security layers that strip or neutralize hidden text, zero-font strings, and suspicious HTML/CSS metadata from incoming external emails before they reach AI processing or summarization engines.
Prompt Injection Detection: Deploy advanced email security solutions capable of identifying and blocking prompt injection patterns designed to manipulate LLM outputs.
Enforce Human-in-the-Loop Controls: Mandate that critical financial transactions, vendor banking modifications, and high-value approvals undergo strict human verification, prohibiting AI summaries from serving as sole authorizers for sensitive business operations.
Reframe External Data Trust: Treat all external communications strictly as untrusted data to be analyzed rather than instructional directives to be obeyed by automated agents.
Conclusion
The findings from Fortra and Barracuda serve as a stark reminder that the cybersecurity arms race is shifting toward the abuse of trust. By turning legitimate administrative tools into surveillance mechanisms and manipulating AI assistants into compliance, attackers are exploiting the very efficiencies organizations implement to stay competitive. Mitigating these risks requires security leaders to look beyond traditional perimeter defenses, enforcing rigorous endpoint governance, robust application allowlisting, and uncompromising validation protocols for both human users and automated systems alike.
