Phishing Attacks Increasingly Exploit Remote Management Tools and AI E-mail Assistants, Reports Find
Phishing attacks are increasing their use of legitimate remote management software to take over computers and hidden instructions to manipulate AI e-mail assistants, according to two recent security reports.
The findings from Fortra and Barracuda show how attackers are reaching beyond stolen passwords to exploit tools employees and admins already trust. One approach turns a fake bank support interaction into ongoing access to a target's device. The other attempts to alter how an AI assistant describes a malicious message, potentially giving employees a reason not to trust it.
Together, the reports point to a broader challenge for IT teams: Following an attack now requires examining what happens after a message reaches an inbox, including software installations and automated processing.
Fortra recently reported it's recorded 475% more phishing attacks incorporating remote monitoring and management tools during the first nine months of 2026 than during all of 2025. The campaigns have targeted North American financial institutions, with particular interest in commercial banking accounts.
Remote monitoring and management, or RMM, software allows IT staff to access and maintain computers remotely. Attackers are using those same capabilities to keep access after persuading victims to install the software.
The attack can begin with a phone call, e-mail, or text warning about a serious bank account problem. Victims are directed to a counterfeit banking website featuring what appears to be a customer support chat.
Behind the curtain, the page checks the visitor's operating system. If a target opens a chat, that could trigger a download of the appropriate remote management app — most commonly AnyDesk.
An attacker then walks the victim through installation and asks for the connection key needed to access the computer. That interaction turns a supposed support session into an opportunity to "continuously watch everything occurring on the infiltrated device," Fortra wrote.
The consequences can extend well beyond the initial banking scam. Fortra said attackers could steal credentials and personal information, install ransomware or additional access tools, use the computer in other campaigns, or sell access through criminal marketplaces.
The software's legitimate purpose complicates detection. A security control looking for malicious applications may recognize an established administration tool without recognizing that an unauthorized person is using it.
Fortra first observed these campaigns targeting U.S. financial institutions in 2025's third quarter. Activity peaked in the first quarter of 2026, when attackers used standardized fake banking support pages and Firebase-hosted phishing links to deliver AnyDesk downloads.
AnyDesk subsequently restricted direct downloads originating from Firebase domains after being notified of the abuse. Fortra said that reduced new attacks, but operators adapted by hosting executables elsewhere and experimenting with other hosting services. They also concealed download redirects inside embedded webpage elements.
Fortra emphasized "Maintaining an allowlist for supported RMM tools" alongside blocking unauthorized installations. It also urged financial institutions to help customers recognize fake support interactions.
Barracuda's report describes another way attackers can exploit workplace trust: by targeting an employee and the employee's AI assistant through the same e-mail.
A message can contain a typical phishing lure alongside concealed instructions intended for the system summarizing it. Those instructions may push an assistant to label the message legitimate or urgent, in the hopes of raising user engagement.
"Protecting the inbox is no longer enough," Barracuda threat analyst Guruprasad Kenja wrote.
Barracuda found that attackers hide instructions in parts of an e-mail people cannot see, including invisible text and the code behind the message. In one example, an invoice e-mail told an AI assistant to add an urgent request to change a vendor's payment details to its summary.
"No single security control will stop every variation of these attacks," Kenja wrote.
Barracuda recommended removing hidden content before AI processing, detecting prompt injection, limiting assistant permissions, validating outputs, and requiring human approval for sensitive actions. External messages should remain data to analyze, rather than instructions to obey.
For more information, check out the Fortra and Barracuda blog posts.