RMM Phishing: Stop Fake DocuSign Remote Access

The email looks routine: a contract is waiting for your signature, an eCard is holding a greeting from a colleague, an invoice needs review. You click, a familiar-looking DocuSign page loads, and you approve a download to "view the document." Nothing your antivirus flags. No malware quarantined. No alert fired. Days later, an attacker is quietly operating inside your network — using the same remote-support software your own IT team relies on.

That is the defining trick of a fast-growing 2026 threat class that security researchers call phishing-to-RMM. Instead of dropping a virus, attackers convince employees to install a legitimate, digitally signed remote monitoring and management (RMM) tool — ScreenConnect, MeshAgent, LogMeIn Resolve, Kaseya, and others — then use that tool as a hands-on-keyboard backdoor. Two research reports published in July 2026, from managed cybersecurity vendors BlueVoyant and Forescout, show the technique has matured into a scalable, cross-platform operation aimed squarely at small and midsize businesses.

Phishing-to-RMM inverts the usual attack: the "payload" is trusted software the victim installs willingly.

What the July 2026 Research Actually Found

Two independent analyses landed within a week of each other, and together they describe the same broad playbook from different angles.

On July 20, 2026, BlueVoyant detailed a reusable DocuSign-themed phishing kit deployed across numerous unrelated domains that shared consistent staging logic, URL structures, and delivery workflows. Rather than hand-building a page per campaign, the operators run a scalable framework that rotates among legitimate RMM platforms and — notably — added dedicated Windows and macOS delivery paths. BlueVoyant's telemetry indicated a sustained operation running from at least May through July 2026, not a one-off blast [BlueVoyant / eSecurity Planet].

On July 14, 2026, Forescout published its analysis of a campaign it named SeasonalInvite, active since at least January 2026. Its signature is a rotating set of lures pegged to the calendar — tax and Social Security themes in winter, then Valentine's, Easter, and spring party invitations. Victims pass through a traffic distribution system (TDS) before reaching a page impersonating greeting-card service BlueMountain, which shows a loading animation and, after roughly three seconds, auto-downloads an OS-specific installer. Forescout confirmed abuse of four RMM tools — ConnectWise ScreenConnect, LogMeIn Resolve, Kaseya, and O&O Syspectr — and mapped infrastructure spanning 959 eCard-themed domains and a TDS using 2,658 gate pages to route real victims while blocking automated security scanners [Forescout].

Forescout also assessed that the operator likely used a large language model to stitch code fragments into a single landing page handling OS detection, animation, and Telegram-based reporting — lowering the cost of producing fresh variants and helping explain the sheer breadth of the domain footprint.

Why Signed RMM Installers Slip Past Basic Defenses

Traditional endpoint protection is built to answer one question: is this file known-bad? A commercial RMM installer answers that question with a confident "no." It is signed by a real software vendor, distributed to thousands of legitimate IT departments, and carries a clean reputation. Every property that makes antivirus and browser reputation engines trust it is genuine.

That trust is the attack. Consider what the defender is actually up against:

• Valid code-signing certificates: The installer's signature checks out because it is the vendor's software. SmartScreen and Gatekeeper reputation heuristics have little reason to object.
• A legitimate business purpose: RMM tools are supposed to grant remote control, run scripts, and transfer files. There is no "malicious" API to detect — the abuse looks identical to sanctioned support work.
• The user did it on purpose: The victim clicked, approved the prompt, and entered their password. Many controls treat user-initiated installs as inherently more trustworthy.
• Portable and silent variants: As CISA warned in its 2023 advisory (AA23-025A), actors often deploy self-contained, portable RMM executables configured to phone home to the attacker's server — sidestepping controls that only audit or block installed software [CISA].

There is one more wrinkle that makes this worse than "just a legitimate tool." Researchers observed installer scripts that attempt to elevate through UAC, disable SmartScreen, weaken Microsoft Defender, and strip the Mark-of-the-Web before running a quiet msiexec install. A useful tell for defenders: a mismatch between an installer's on-disk filename and the signed product name in its certificate subject [Microsoft Security]. That is a behavioral indicator your endpoint detection and response platform can catch even when the signature is valid.

How the Windows and macOS Delivery Paths Differ

A defining feature of both campaigns is genuine cross-platform targeting. The landing page detects the visitor's operating system and serves a matching installer, and the two paths abuse different platform mechanics to reach the same outcome: a running, attacker-controlled RMM agent.

The practical implication for a mixed-fleet SMB is that a Windows-only mindset leaves half the door open. Mac endpoints are frequently excluded from application-control policies and RMM inventories, which is exactly the gap these kits now exploit. Whatever detection and allowlisting strategy you build has to cover both platforms.

The Approval Prompts Users Are Being Trained to Accept

Every one of these campaigns depends on a person clicking "yes." The genius — and the danger — is that the prompts users see are the real operating-system dialogs, not counterfeits. Years of legitimate software installs have trained employees to treat these as speed bumps rather than decisions.

This is why security awareness training for this threat has to be specific, not generic. Employees do not need another "don't click links" lecture; they need to internalize one concrete rule: a document, invoice, or greeting card should never ask you to install software or approve an admin prompt. If a "DocuSign" or "eCard" page triggers a UAC box or a macOS password request, that is the moment to stop and report — because a real document never does.

The chain: lure → traffic distribution system → OS-specific installer → user approval → persistent RMM agent phoning home.

A Four-Part Response Plan for SMB Leaders

You cannot block "legitimate software" with a signature, so the defense shifts to governance, visibility, and rehearsed response. The following plan maps directly to the guidance CISA, NSA, and MS-ISAC issued for RMM abuse — adapted for a resource-constrained SMB.

1. Inventory your approved RMM tools

You cannot flag the unauthorized until you have defined the authorized. Document every RMM and remote-access product your business — and your outsourced IT provider — legitimately uses, including vendor, agent process names, installation paths, and the cloud domains each agent connects to. Everything outside that list becomes a signal. If you run managed IT services, your provider should be able to hand you this allowlist on request; if they cannot, that is a finding in itself.

2. Alert on unauthorized installs and execution

With a baseline in hand, configure detection to fire whenever an RMM agent appears or runs outside the approved list. This is squarely an EDR and application-control task: alert on new RMM process execution, on the signed-name/filename mismatch described above, and on outbound connections to known RMM cloud domains that are not on your allowlist. Application control should block execution of portable RMM binaries, not just installed ones — that is the exact gap CISA called out. Feed these alerts into whoever watches your network monitoring so a hit gets human eyes quickly.

3. Harden email and web filtering

The cheapest place to break this attack is before the click. Strong email security should catch DocuSign and eCard impersonation, sandbox suspicious links, and strip or detonate download URLs. Because SeasonalInvite fronts its payloads with a traffic distribution system across hundreds of throwaway domains, protective DNS and web filtering that blocks newly registered and low-reputation domains removes a large share of the lures. At the network edge, follow CISA's advice and block inbound and outbound connections on common RMM ports and protocols that your approved tools do not require — a job for a properly configured managed firewall.

4. Preserve endpoint evidence after discovery

When you do find an unauthorized RMM agent, resist the urge to immediately reimage the machine. Because the intruder had interactive, hands-on-keyboard access, you need to understand what they touched before you destroy the record. Isolate the endpoint from the network, but keep it powered and intact.

• Isolate, don't power off: Network-isolate through your EDR so volatile memory and running state survive for analysis.
• Capture the essentials: RMM agent logs, install timestamps, the installer file itself, process and network telemetry, and any new local accounts or scheduled tasks.
• Reconstruct the session: RMM tools log their own sessions — pull the connection times and source addresses to scope what the attacker did.
• Hunt for lateral movement: Look for the same agent, accounts, or outbound domains on other endpoints before declaring the incident contained.
• Rotate exposed credentials: Assume anything typed or stored on that endpoint is compromised and reset it.

Most SMBs do not have an in-house team to run this sequence at 2 a.m., which is where a partner with 24/7 detection and cybersecurity consulting depth changes the outcome — the difference between a contained hour and an undiscovered month.

The Bottom Line

Phishing-to-RMM works because it weaponizes trust — in signed software, in familiar brands like DocuSign, and in the everyday approval prompts employees have learned to wave through. The BlueVoyant and Forescout research confirms this is no longer a niche technique but an industrialized, AI-assisted, cross-platform operation with hundreds of domains behind it. For SMB leaders, the takeaway is refreshingly concrete: you defend against it not with a better antivirus, but with a clear inventory of what belongs, fast alerting on what doesn't, tighter email and web filtering, and the discipline to preserve evidence before you clean up. Those four habits turn a silent backdoor into a caught intruder.

Sources

• Forescout — "SeasonalInvite: New Phishing Campaign Abuses eCards and RMM" (July 14, 2026)
• eSecurity Planet — "DocuSign Phishing Kit Delivers RMM Tools to Windows and macOS" (BlueVoyant analysis, July 2026)
• Microsoft Security Blog — "Signed malware impersonating workplace apps deploys RMM backdoors" (March 2026)
• CISA / NSA / MS-ISAC — "Protecting Against Malicious Use of Remote Monitoring and Management Software" (AA23-025A)
• Infosecurity Magazine — "Phishing Campaign Abuses eCards to Deploy RMM Tools"