Hijacked remote access tools: an “if… then…” decision tree for SMBs
A fake “service agreement” lands in an inbox. The employee clicks, downloads the document… and actually installs a perfectly legitimate remote access tool. Minutes later, the attacker adds three more on the same computer, in case one gets removed. This is a real case described by Huntress, which published its ranking of the tactics doing the most damage to businesses on October 1, 2026.
The problem: these tools (often called RMM, for remote monitoring and management) are the same ones your IT provider uses to help you. Antivirus doesn’t see them as viruses. So you need a simple rule to decide what to do. Here it is, as a decision tree.
45%
of endpoint incidents Huntress investigated in Q1 2026 involved a hijacked remote access tool
1 click
on a fake agreement: Tiflux, then UltraVNC, Splashtop and ScreenConnect on the same device
24.6%
of identity threat signals in 2026 point to mailbox manipulation (Huntress)
These percentages measure different things (endpoint incidents vs identity signals), so they can’t be added up or compared with each other.
The decision tree: a remote access tool shows up
Starting point: someone asks you to install a remote control tool, or you spot one on a computer (unknown icon, a “session in progress” window, a mouse moving on its own). Go through the questions in order.
QUESTION 1
Does the request come from an email, a call or a web page (“agreement”, “shared document”, “update”, fake CAPTCHA)?
IF YES, THEN…
Install nothing. Call your IT provider at the number you already know, never the one in the message. A real technician won’t mind that you checked.
If no ↓
QUESTION 2
Is the tool on the company’s list of approved tools?
IF NO (OR YOU DON’T KNOW), THEN…
Disconnect the computer from the network (cable and Wi-Fi) without shutting it down, to preserve evidence. Call IT. No list of approved tools? That’s your first project.
If yes ↓
QUESTION 3
Are there several remote access tools on the same computer?
IF YES, THEN…
Treat it as an incident. Stacking tools to keep several ways back in is exactly what the attacker did in the Tiflux case. Isolate the computer and have each tool checked.
If no ↓
QUESTION 4
Does the current session match a known request (ticket, scheduled call, normal hours)?
IF NO, THEN…
End the session, alert IT, change the account’s password from a different device, and have the mailbox rules checked (see below).
If yes ↓
Everything checks out: approved tool, alone on the computer, expected session. Let your technician work, and note the time and reason. That log will help the day something doesn’t add up.
Why this trap works so well
- The tool is legitimate. A copy installed by an attacker behaves like the approved one: persistent access and remote commands that look like ordinary admin work. Huntress describes the category as “one hop away” from ransomware or data theft.
- The lure is believable. In the case Huntress studied, the email led to a CAPTCHA-gated page, then to a fake “service agreement” download. The file, named Network Solutions Agreement.msi, was actually the Tiflux installer. Huntress already sees lures like these written with AI.
- One click opens several doors. After Tiflux, the intruder added UltraVNC, Splashtop and in some cases ScreenConnect. The Tiflux installer also bundled an outdated, vulnerable driver, raising the risk further.
The same reflex for your mailbox
Huntress places mailbox manipulation in the same “critical” corner: an intruder creates a rule that quietly moves a supplier’s replies into a folder nobody watches, then swaps an invoice to redirect a payment. If question 4 of the tree led you to “no”, have those rules checked. We described the session-theft technique that bypasses MFA in our article on FlowerStorm and AiTM phishing.
Three rules to put in place this week
- A written list of approved remote access tools (ideally just one), known to every employee.
- No administrator rights for users: without them, installing software is blocked or requires approval.
- An alert when a new remote access tool appears on a computer. Huntress suggests asking your IT team plainly: “Which tools are approved, and what tips you off when another one shows up?”
How NeoTech can help
For SMBs in Laval, Montréal and the North Shore, we inventory the remote access tools installed, remove the ones that don’t belong and take away unnecessary admin rights. Our automated 24/7 monitoring with an on-call technician response flags any unapproved tool that appears. See also our cybersecurity services and our Microsoft 365 services for mailbox rules.
Book your free cyber check
Not sure how many remote access tools are running on your computers, or who installed them? In a short meeting, we review it with you and prioritize the fixes.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- Huntress — The Huntress Tragic Quadrant (October 1, 2026)
- Huntress — Threat Actors Weaponize Tiflux RMMs in Malspam Attacks
- Help Net Security — How RMM abuse gives attackers a way in that looks like business as usual (October 5, 2026)
Photo: Dmitry Shibanov (Pexels).