{"id":"CMP-202610-phishing-tricks-users-into-enrolling-their-pcs-in-attacker-c","kind":"campaign","aliases":[],"related":[],"title":"Phishing tricks users into enrolling their PCs in attacker-controlled Hexnode or Rippling MDM, which then keeps reinstalling ScreenConnect for remote access","description":null,"summary":"Huntress (2026-10-28) reports several recent incidents where attackers use business-themed phishing (proposal/DocuSign lures, fake Microsoft Teams meeting invites, sent by email and messaging apps) to get Windows users to install a legitimate MDM agent (Hexnode, via a fake eD0cuSign_Installer.msi) or enroll the device into an attacker-owned Rippling MDM tenant. The MDM then runs ScreenConnect as SYSTEM, connecting to attacker relays; removing ScreenConnect does not help because the MDM reinstalls it hours later. No product vulnerability is involved; any organization whose staff can install software or enroll devices is at risk. Start date unknown (described as recent). Other MDM products could be abused the same way.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-28T13:14:51+00:00","products":[{"name":"Hexnode UEM","fixed":[],"vendor":"Hexnode"},{"name":"Rippling MDM","fixed":[],"vendor":"Rippling"},{"name":"ScreenConnect","fixed":[],"vendor":"ConnectWise"},{"name":"Windows","fixed":[],"vendor":"Microsoft"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look for MDM agents or enrollments you did not authorize: Hexnode agent/Hexnode Gateway with bundled PostgreSQL, a Rippling enrollment registry key, C:\\Rippling\\daemon.exe, MSIs under C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\mdm\\. Look for a file named eD0cuSign_Installer.msi, and for ScreenConnect that comes back after removal. Network IOCs: webdocusign.viewportal[.]es, teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham[.]com, and ScreenConnect relays relay.bobdthjau[.]com:8041 and relay.pronconetydesire[.]online:8041.","fix":"Keep an allowlist of approved MDM products, tenants and RMM instances, and treat any other enrollment or agent as an incident. Block the IOC domains. If a device is hit: isolate it, remove it from the rogue MDM tenant and uninstall the MDM agent (not only ScreenConnect), disable attacker accounts, revoke sessions/tokens, reset credentials, reimage if in doubt. Warn staff about unexpected proposal-review, DocuSign and Teams-meeting links that ask them to install something.","status":"open","published_at":"2026-10-28T00:00:00+00:00","first_seen_at":"2026-10-28T13:14:51+00:00","triaged_at":"2026-10-28T13:14:51+00:00","updated_at":"2026-10-28T13:14:51+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':49B '-202610':25A '-28':50B '2026':48B 'abus':154B 'access':23A 'agent':84B 'app':74B 'attack':10A,56B,97B,111B 'attacker':35A 'attacker-control':9A 'attacker-own':96B 'busi':59B 'business-them':58B 'c':36A 'campaign':43B 'cmp':24A 'connect':109B 'control':11A 'could':152B 'date':144B 'describ':146B 'devic':93B,139B 'earli':45B 'early-warn':44B 'ed0cusign_installer.msi':89B 'email':71B 'enrol':5A,91B,138B 'enrolling':31A 'fake':64B,88B 'get':76B 'help':117B 'hexnod':12A,85B 'hexnode':37A 'hour':123B 'huntress':47B 'in':34A 'incid':54B 'instal':80B,135B 'into':30A 'invit':68B 'involv':129B 'keep':18A 'later':124B 'legitim':82B 'lure':63B 'mdm':15A,40A,83B,100B,103B,120B,150B 'meet':67B 'messag':73B 'microsoft':65B 'organ':131B 'own':98B 'pcs':7A,33A 'phish':1A,61B 'phishing':27A 'phishing-tricks-users-into-enrolling-their-pcs-in-attacker-c':26A 'product':126B,151B 'proposal/docusign':62B 'recent':53B,148B 'reinstal':19A,121B 'relay':112B 'remot':22A 'remov':113B 'report':51B 'rippl':14A,99B 'rippling':39A 'risk':142B 'run':105B 'screenconnect':20A,41A,106B,114B 'sent':69B 'sever':52B 'softwar':136B 'staff':133B 'start':143B 'system':108B 'team':66B 'tenant':101B 'their':32A 'theme':60B 'trick':2A 'tricks':28A 'uem':38A 'unknown':145B 'use':57B 'user':3A,78B 'users':29A 'via':86B 'vulner':127B 'warn':46B 'way':157B 'whose':132B 'window':77B 'windows':42A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-phishing-tricks-users-into-enrolling-their-pcs-in-attacker-c","url":null,"severity":null,"published_at":"2026-10-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-28T13:14:51+00:00","fetched_at":"2026-10-28T13:14:51+00:00","note":null}],"documents":[{"id":10533,"url":"https://www.huntress.com/blog/attackers-turn-mdm-into-remote-access","title":"Huntress: Managed for Malice: How Attackers Turn MDM into Remote Access","kind":"blog","source":"blog","text":"Managed for Malice: How Attackers Turn MDM into Remote Access\n\nAttackers abuse legitimate MDM platforms to deploy rogue RMM tools, turning device management into a pathway for remote access and persistence.","published_at":"2026-10-28T16:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}