Attackers hid in remote IT tools in 45 percent of the computer break-ins Huntress saw

Security firm Huntress found attackers using legitimate remote monitoring and management software in 45 percent of the endpoint incidents it recorded in the first quarter of 2026, and says this tactic rose 277 percent year on year in 2025. Because IT teams use these tools to manage computers from anywhere, an intruder who installs one gets lasting access that looks like ordinary admin work. In one case a fake service agreement installed one tool and the intruder then added three more.

• Ask whoever looks after your IT which remote-support tools are approved on your computers, and what would alert them if an unapproved one appeared.
• Warn staff that a fake invoice, contract or service agreement is a common way in, and agree that anything unexpected is checked by phone with the sender before it is opened.

Source: Help Net Security. This is our short summary of their reporting. The paragraphs marked "Our read" and the things to do are SeedFoundry's opinion. The summary is drafted with AI tools. The picture is our own graphic. How we source and credit