Cybersecurity researchers have detected a dramatic surge in fraudulent schemes aimed at compromising financial institutions and their clients. According to data published by Fortra's Intelligence and Research Experts (FIRE), phishing attacks using remote management tools surged almost fivefold in the first nine months of 2026 compared with all of 2025. These sophisticated campaigns focus heavily on retail and commercial banking customers. Threat actors deploy deceptive support portals that mimic official banking communications and convince unsuspecting users to install legitimate software packages.[1]
By blending traditional social engineering tactics with authorized remote-access software, criminals bypass conventional security perimeters and secure direct control over target devices. In an expert comment, Max Ickert, a senior threat researcher at Fortra, highlighted how these operational tactics continue to evolve. "Remote monitoring and management (RMM) tool abuse has been a challenge for defenders for years, but 2026 has marked a notable escalation in phishing campaigns targeting both retail and commercial banking customers."
"Fortra observed a 475% increase in phishing attacks incorporating RMM software during the first nine months of 2026 compared to all of 2025, reflecting a growing shift toward hybrid campaigns that blend social engineering with legitimate remote-access tools," he said.
"The trend highlights how threat actors continue to leverage trusted software to facilitate account compromise, fraud, and gain long-lasting access to systems while evading traditional security controls," Ickert concluded. The primary mechanism behind these incidents involves prompting users to download widely trusted applications, such as AnyDesk, under the guise of technical assistance or account verification. Because enterprise security solutions routinely permit known administration tools, these downloads frequently avoid triggering automated security alerts or anti-malware blocks.
Once a victim runs the installer and grants remote access, attackers establish persistent footholds on target machines. Criminals monitor live user activity, intercept sensitive credentials, and navigate financial applications directly from the victim's local environment. Attackers can also execute secondary payloads, exfiltrate confidential files, or deploy operational ransomware long after the initial deceptive interaction ends.
Relying on legitimate software poses severe challenges for organizational cybersecurity teams. Traditional defense controls often struggle to distinguish legitimate IT maintenance sessions from unauthorized intruder activity conducted through the same software channels. To mitigate these risks, security teams must implement strict application control policies, enforce multi-factor authentication across all endpoints, and educate banking clients about unrequested support interactions. Organizations should regularly review remote access permissions and monitor endpoint behavior for unusual administrative connections.
This article used AI to craft the content and is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments, or assistance, please contact the office directly at 1-844-492-7225 or feedback@redskyalliance.com
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://www.cybersecurityintelligence.com/blog/bank-phishing-attacks-leverage-legitimate-management-tools-9818.html
Comments