How do I check whether I am affected by CMP-202610-phishing-tricks-users-into-enrolling-their-pcs-in-attacker-c?

Look for MDM agents or enrollments you did not authorize: Hexnode agent/Hexnode Gateway with bundled PostgreSQL, a Rippling enrollment registry key, C:\Rippling\daemon.exe, MSIs under C:\Windows\System32\config\systemprofile\AppData\Local\mdm\. Look for a file named eD0cuSign_Installer.msi, and for ScreenConnect that comes back after removal. Network IOCs: webdocusign.viewportal[.]es, teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham[.]com, and ScreenConnect relays relay.bobdthjau[.]com:8041 and relay.pronconetydesire[.]online:8041.

Live › campaign › CMP-202610-phishing-tricks-users-into-enrolling-their-pcs-in-attacker-c

Go to dashboard

high⚡ Early warning · no CVE yetExploited in the wildVendor

Phishing tricks users into enrolling their PCs in attacker-controlled Hexnode or Rippling MDM, which then keeps reinstalling ScreenConnect for remote access

Q: What is the fix for CMP-202610-phishing-tricks-users-into-enrolling-their-pcs-in-attacker-c?

Keep an allowlist of approved MDM products, tenants and RMM instances, and treat any other enrollment or agent as an incident. Block the IOC domains. If a device is hit: isolate it, remove it from the rogue MDM tenant and uninstall the MDM agent (not only ScreenConnect), disable attacker accounts, revoke sessions/tokens, reset credentials, reimage if in doubt. Warn staff about unexpected proposal-review, DocuSign and Teams-meeting links that ask them to install something.

Huntress (2026-10-28) reports several recent incidents where attackers use business-themed phishing (proposal/DocuSign lures, fake Microsoft Teams meeting invites, sent by email and messaging apps) to get Windows users to install a legitimate MDM agent (Hexnode, via a fake eD0cuSign_Installer.msi) or enroll the device into an attacker-owned Rippling MDM tenant. The MDM then runs ScreenConnect as SYSTEM, connecting to attacker relays; removing ScreenConnect does not help because the MDM reinstalls it hours later. No product vulnerability is involved; any organization whose staff can install software or enroll devices is at risk. Start date unknown (described as recent). Other MDM products could be abused the same way.

Summary written from the sources below. Check the originals before acting.

Known so far

4/6

high

no CVSS yet; severity from the sources

known so far4 of 6

missing: versions, primary source

First public: Oct 28, 2026 UTC
Last modified: Oct 28, 2026
Status: open
Known exploitation: Yes
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-28 13:14 UTC. All times on this page are UTC.

Who is affected

4 products

Product	Ecosystem	Affected	Fixed in
Hexnode UEM	–	–	–
Rippling MDM	–	–	–
ScreenConnect	–	–	–
Windows	–	–	–

Who cares: campaign, early-warning
Not affected if: –

How to check

Look for MDM agents or enrollments you did not authorize: Hexnode agent/Hexnode Gateway with bundled PostgreSQL, a Rippling enrollment registry key, C:\Rippling\daemon.exe, MSIs under C:\Windows\System32\config\systemprofile\AppData\Local\mdm\
Look for a file named eD0cuSign_Installer.msi, and for ScreenConnect that comes back after removal
Network IOCs: webdocusign.viewportal[.]es, teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham[.]com, and ScreenConnect relays relay.bobdthjau[.]com:8041 and relay.pronconetydesire[.]online:8041

Know the next one before it finds you.

Add to Slack

Phishing tricks users into enrolling their PCs in attacker-controlled Hexnode or Rippling MDM, which then keeps reinstalling ScreenConnect for remote access

Summary written from the sources below. Check the originals before acting.

Product

Ecosystem

Affected

Fixed in

Hexnode UEM

–

Rippling MDM

–

ScreenConnect

–

Windows

–

Phishing tricks users into enrolling their PCs in attacker-controlled Hexnode or Rippling MDM, which then keeps reinstalling ScreenConnect for remote access

Who is affected

How to check

Know the next one before it finds you.

Phishing tricks users into enrolling their PCs in attacker-controlled Hexnode or Rippling MDM, which then keeps reinstalling ScreenConnect for remote access

Who is affected

How to check

Know the next one before it finds you.

The fix

Who had it, and when

Sources