Managed for Malice: How Attackers Turn MDM into Remote Access
Huntress, Wednesday, October 28th, 2026
Huntress reports attackers abusing legitimate MDM platforms such as Hexnode and Rippling to deploy rogue RMM tools and keep remote access.
Huntress observed incidents where threat actors used MDM applications as legitimate tools rather than exploiting vulnerabilities.
Attacks start with social engineering through business-themed lures sent by messaging apps and email, after which the victim device is enrolled in the attacker's MDM, giving a trusted, privileged management path used to install unauthorized RMM tools such as ScreenConnect.
In one case, a ScreenConnect agent kept reappearing hours after removal, connecting to the same relay, because the MDM-based access remained in place.
Removing the visible RMM tool does not remove the unauthorized management architecture.