Living Off Trusted Software: ScreenConnect Abuse Across Phishing, Search, and RMM Chains

Attackers are increasingly abusing legitimate, code-signed remote management tools like ScreenConnect—delivered via phishing, SEO poisoning, malvertising, and RMM chaining—to covertly gain persistent, hands-on control of endpoints while evading traditional malware defenses.