Phishing Attacks Increasingly Exploit Remote Management Tools and AI E-mail Assistants, Reports Find
Phishing attacks are increasing their use of legitimate remote management software to take over computers and hidden instructions to manipulate AI e-mail assistants, according to two recent security reports.
The findings from Fortra and Barracuda show how attackers are reaching beyond stolen passwords to exploit tools employees and admins already trust. One approach turns a fake bank support interaction into ongoing access to a target's device. The other attempts to alter how an AI assistant describes a malicious message, potentially giving employees a reason not to trust it.
Together, the reports point to a broader challenge for IT teams: Following an attack now requires examining what happens after a message reaches an inbox, including software installations and automated processing.
Fortra recently reported it's recorded 475% more phishing attacks incorporating remote monitoring and management tools during the first nine months of 2026 than during all of 2025. The campaigns have targeted North American financial institutions, with particular interest in commercial banking accounts.
Remote monitoring and management, or RMM, software allows IT staff to access and maintain computers remotely. Attackers are using those same capabilities to keep access after persuading victims to install the software.
The attack can begin with a phone call, e-mail, or text warning about a serious bank account problem. Victims are directed to a counterfeit banking website featuring what appears to be a customer support chat.
Behind the curtain, the page checks the visitor's operating system. If a target opens a chat, that could trigger a download of the appropriate remote management app — most commonly AnyDesk.
An attacker then walks the victim through installation and asks for the connection key needed to access the computer. That interaction turns a supposed support session into an opportunity to "continuously watch everything occurring on the infiltrated device," Fortra wrote.
The consequences can extend well beyond the initial banking scam. Fortra said attackers could steal credentials and personal information, install ransomware or additional access tools, use the computer in other campaigns, or sell access through criminal marketplaces.
The software's legitimate purpose complicates detection. A security control looking for malicious applications may recognize an established administration tool without recognizing that an unauthorized person is using it.
Fortra first observed these campaigns targeting U.S. financial institutions in 2025's third quarter. Activity peaked in the first quarter of 2026, when attackers used standardized fake banking support pages and Firebase-hosted phishing links to deliver AnyDesk downloads.
AnyDesk subsequently restricted direct downloads originating from Firebase domains after being notified of the abuse. Fortra said that reduced new attacks, but operators adapted by hosting executables elsewhere and experimenting with other hosting services. They also concealed download redirects inside embedded webpage elements.
Fortra emphasized "Maintaining an allowlist for supported RMM tools" alongside blocking unauthorized installations. It also urged financial institutions to help customers recognize fake support interactions.
Barracuda's report describes another way attackers can exploit workplace trust: by targeting an employee and the employee's AI assistant through the same e-mail.
A message can contain a typical phishing lure alongside concealed instructions intended for the system summarizing it. Those instructions may push an assistant to label the message legitimate or urgent, in the hopes of raising user engagement.
"Protecting the inbox is no longer enough," Barracuda threat analyst Guruprasad Kenja wrote.
Barracuda found that attackers hide instructions in parts of an e-mail people cannot see, including invisible text and the code behind the message. In one example, an invoice e-mail told an AI assistant to add an urgent request to change a vendor's payment details to its summary.
"No single security control will stop every variation of these attacks," Kenja wrote.
Barracuda recommended removing hidden content before AI processing, detecting prompt injection, limiting assistant permissions, validating outputs, and requiring human approval for sensitive actions. External messages should remain data to analyze, rather than instructions to obey.
For more information, check out the Fortra and Barracuda blog posts.
Featured
-
Gartner Marks Enterprise Move from AI Experiments to AI Engineering
According to Gartner's recent "Hype Cycle for Enterprise Architecture, 2026" report, enterprises are moving from AI experimentation toward a more industrialized approach to AI delivery.
-
Cybersecurity Researchers: AI Has Crossed into the Live Attack Chain
AI is moving beyond assisting cybercriminals and beginning to operate within live attacks, according to a new report from Check Point Research. The technology is making sophisticated capabilities faster and more accessible while creating new security risks for businesses deploying their own AI systems.
-
Before AI, Fix Your Data
Institutions don't have to solve every data problem before they can begin using AI responsibly. But they do need to treat information as a strategic asset — not a byproduct of operations — and start building toward AI-ready data now.
-
California Governor Proposes Independent Watchdogs Within AI Safety System
California Governor Gavin Newsom is proposing a new model of artificial intelligence regulation that would give independent organizations a formal role in evaluating the safety claims made by leading AI companies.