Researchers at Fortra are tracking a surge in phishing attacks targeting bank accounts via remote monitoring and management (RMM) tools.
“Hybrid phishing-to-RMM campaigns have emerged as a potent method to target North American financial institutions, with a focused interest in business commercial banking accounts,” Fortra says. “Through the first nine months of 2026, Fortra has recorded 475% more phishing attacks incorporating RMM tools into the phishing attack chain compared to the entire previous year.”
Attackers use social engineering to trick victims into installing the tools by directing them to a phishing page, supposedly to address an urgent problem with their bank account.
“These attacks are particularly challenging as the common IT software tools deployed are seen as legitimate by basic system security measures, easily bypassing any guardrails aimed at malicious applications,” the researchers write. “Attacks likely begin with a call, email, or text warning the victim about serious issues regarding their bank account and direct them to a malicious website that mimics their financial institution. The phishing page centers a ‘live chat’ function for customer support and includes code that determines the type of operating system used to access the webpage. Once the victim clicks to open the live chat, the appropriate version of the RMM software, most commonly AnyDesk, automatically begins to download.”
Abuse of legitimate RMM tools is nothing new, but the increased focus on commercial banking institutions is an emerging trend.
“The use of this tactic in campaigns targeting US financial institutions was first observed in Q3 2025,” Fortra says. “Prior to these campaigns, RMM utilization alongside phishing content was primarily observed in attacks imitating IT services and limited campaigns focused on international banking brands. The US-targeted phishing kits observed were comparable to campaigns targeting Canadian banks earlier in 2025. Consistent with trends seen more broadly in the phishing threat landscape, most campaigns were aimed specifically at commercial banking brands.”
Fortra has the story: https://www.fortra.com/blog/increase-credential-phishing-remote-management-tools
