---
id: "CMP-202610-phishing-tricks-users-into-enrolling-their-pcs-in-attacker-c"
kind: "campaign"
aliases: []
title: "Phishing tricks users into enrolling their PCs in attacker-controlled Hexnode or Rippling MDM, which then keeps reinstalling ScreenConnect for remote access"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Hexnode UEM", "fixed": [], "vendor": "Hexnode"}, {"name": "Rippling MDM", "fixed": [], "vendor": "Rippling"}, {"name": "ScreenConnect", "fixed": [], "vendor": "ConnectWise"}, {"name": "Windows", "fixed": [], "vendor": "Microsoft"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: "2026-10-28T00:00:00+00:00"
first_seen_at: "2026-10-28T13:14:51+00:00"
updated_at: "2026-10-28T13:14:51+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-28T13:14:51+00:00"}]
---

# Phishing tricks users into enrolling their PCs in attacker-controlled Hexnode or Rippling MDM, which then keeps reinstalling ScreenConnect for remote access

Huntress (2026-10-28) reports several recent incidents where attackers use business-themed phishing (proposal/DocuSign lures, fake Microsoft Teams meeting invites, sent by email and messaging apps) to get Windows users to install a legitimate MDM agent (Hexnode, via a fake eD0cuSign_Installer.msi) or enroll the device into an attacker-owned Rippling MDM tenant. The MDM then runs ScreenConnect as SYSTEM, connecting to attacker relays; removing ScreenConnect does not help because the MDM reinstalls it hours later. No product vulnerability is involved; any organization whose staff can install software or enroll devices is at risk. Start date unknown (described as recent). Other MDM products could be abused the same way.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Hexnode UEM affected ? fixed ?
- :Rippling MDM affected ? fixed ?
- :ScreenConnect affected ? fixed ?
- :Windows affected ? fixed ?

## How to check

Look for MDM agents or enrollments you did not authorize: Hexnode agent/Hexnode Gateway with bundled PostgreSQL, a Rippling enrollment registry key, C:\Rippling\daemon.exe, MSIs under C:\Windows\System32\config\systemprofile\AppData\Local\mdm\. Look for a file named eD0cuSign_Installer.msi, and for ScreenConnect that comes back after removal. Network IOCs: webdocusign.viewportal[.]es, teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham[.]com, and ScreenConnect relays relay.bobdthjau[.]com:8041 and relay.pronconetydesire[.]online:8041.

## Fix

Keep an allowlist of approved MDM products, tenants and RMM instances, and treat any other enrollment or agent as an incident. Block the IOC domains. If a device is hit: isolate it, remove it from the rogue MDM tenant and uninstall the MDM agent (not only ScreenConnect), disable attacker accounts, revoke sessions/tokens, reset credentials, reimage if in doubt. Warn staff about unexpected proposal-review, DocuSign and Teams-meeting links that ask them to install something.

## Timeline

- 2026-10-28T13:14:51+00:00 analyst

## Documents

- [describes] Huntress: Managed for Malice: How Attackers Turn MDM into Remote Access https://www.huntress.com/blog/attackers-turn-mdm-into-remote-access

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_