Who is allowed to take control of your screen?
Remote support software is how your IT provider fixes your laptop. In September it was also how attackers got in, by two different routes.
Every managed IT provider runs a remote access agent on its clients' machines. It is how a password problem at 8am gets fixed without anyone driving to the office. It also means a piece of software on every device you own can, by design, take full control of it. September 2026 produced two clear examples of what that means in practice.
A flaw in the tool itself
On 8 September ConnectWise disclosed CVE-2026-84869 in ScreenConnect, one of the most widely used remote support products among IT providers. Rated 9.9 out of 10, it allowed files to be transferred and run on a client machine through an active remote session without the person at that machine approving it. Researchers had seen it exploited since late August. CISA added it to its known exploited vulnerabilities list on 11 September.
The fix is version 26.6.5. The detail that tends to get missed is that ConnectWise asks for the client on each machine to be updated as well as the server. A provider who patched the console and stopped there is still exposed.
The tool the attacker installed
The second example needed no flaw at all. On 29 September Microsoft published research on phishing campaigns it had tracked since July. Staff received what looked like a meeting invitation, a PDF or a software update prompt. What they ran was a genuine, signed installer for MSP360, a legitimate remote management product. Once it was running, the attackers used it to install ScreenConnect as a second way back in, and from there collected information and credentials.
Microsoft found no vulnerability being exploited. The software did exactly what it was built to do, for the wrong people. Antivirus has little reason to object, because the files are signed, the vendors are real, and IT providers install the same products every day.
One control did stop it. The installer needs administrator rights, and where the user could not approve the elevation prompt, the installation failed. Staff working as standard users rather than local administrators is unglamorous, and here it was the difference.
Which remote access tools do you run on our machines? The answer should be one or two named products.
Is MFA enforced on the console you connect from, for every technician?
Can we see a log of every remote session on our machines, with who connected and when?
Is other remote access software blocked from installing, and do our staff work without local administrator rights?
What we run
We use NinjaOne's remote access for client machines and nothing else. Technician sign-in to NinjaOne requires MFA. For some clients we go further and sign in through single sign-on to the client's own Entra ID, so our access is governed by that client's MFA enforcement and Conditional Access policies, and they can switch it off themselves. Sessions are logged per device, so any client can ask for the session history on their machines. If a ScreenConnect, AnyDesk or TeamViewer agent turns up on a device we manage, it did not come from us, and we treat it as an incident until we know where it came from.
One sentence for your staff
IT will never send you a link to install remote support software. If something asks for administrator approval and you were not expecting it, say no and call us.