A September 29 report links phishing to unauthorized remote access and credential theft, leaving affected organizations and the extent of recovery undisclosed.
On September 29, Microsoft Defender Experts reported phishing campaigns observed across several industries in July 2026. Attackers abused legitimate remote administration software to maintain access and collect information and credentials. The report names no victims, gives no victim count and attributes the activity to no named actor.
Microsoft explicitly said it had not observed exploitation of ScreenConnect itself. It reports detection coverage and recommends restricting unapproved remote access. Those statements do not establish that every intrusion was stopped or that affected organizations fully recovered.
The practical issue for a business is who authorized access. An approved product can still support an unauthorized session. A review should establish who requested an installation, who approved it, what the operator is permitted to do and who can end access when its purpose expires. The review should also account for currently active connections.
Layer8’s Cybersecurity offering combines a scoped readiness assessment, prioritized corrective work, implementation pilots and validation. For this scenario, an engagement could review installation authority, remote access permissions and responsible owners, then pilot agreed restrictions with a rollback plan. Suspected compromise would need an explicitly authorized response scope.
Acceptance should include a controlled check that withdrawn access can no longer connect, approved support work still succeeds and the assigned owner receives the result. Retain those outcomes alongside the approval record. This could reduce unauthorized access and clarify containment responsibility; it would not prove that historical data theft had been undone.