What happened – the remote support scam
A client experienced firsthand how quickly a small action can turn into a major security risk, and how the right security approach can stop it cold.
Last week, we kicked off onboarding for a new client with an onsite visit to handle the usual first-day essentials: deploying our security stack and installing our RMM agent across key systems.
During that work, the owner of the company mentioned his computer had been acting weird. He had intermittent internet access issues, odd “blocked” messages, and (most concerning) a login screen that didn’t look like the normal Windows sign-in, even though his usual desktop appeared after logging in.
That combination set off alarms. Our investigation quickly confirmed the root cause: a malicious remote connection agent had been installed months earlier. The attacker appears to have been waiting for the right moment to execute their next step, which was replacing the Windows logon screen with a convincing imitation. The goal was simple and nasty: capture the user’s password as soon as it was typed, effectively handing the attacker the keys.
Here’s the part we’re proud of (and grateful for): because Huntress had been deployed that day, the moment the script began executing, the machine was automatically isolated from the rest of the network. That containment step prevented the incident from becoming a “spread and encrypt” situation or granting the attacker full access to the entire network.
We immediately reset the owner’s password, removed the rogue ScreenConnect instance, and only released isolation after we confirmed the system was clean. Meanwhile, our dedicated SOC team ran a full investigation and delivered a detailed report within the hour, including what happened, how it happened, and the exact commands the attacker attempted to run.
The risks behind a remote support scam: WHY THIS MATTERS
The worst threats are the ones you don’t see.
Most people picture cyberattacks as loud – pop-ups, ransomware notes, obvious “your computer is hacked” drama. In reality, many of the most damaging incidents look normal on the surface. Threat actors can sit quietly on a system for months, blending in, poking around, reading sensitive information, and potentially exfiltrating data long before anyone notices anything is wrong.
By the time the “symptoms” show up, the real damage may already be underway. That’s why layered protection and fast containment matter: they don’t just stop the flashy attacks, they catch the silent ones before they turn into a full-blown business outage.
Protecting your business from a remote support scam:
This incident is a textbook example of why businesses can’t rely on a single line of defense. Spot Migration’s approach combines:
- Endpoint protection (to detect malicious behavior)
- Managed detection and response (MDR) for 24/7 monitoring
- Automated isolation to stop threats from spreading
- Human expertise to investigate, explain, and resolve issues
- User education to reduce future risk
– No single tool would have been enough on its own. (The previous IT team didn’t notice the breach)
– Antivirus alone wouldn’t have provided the context.
– Monitoring without isolation would have been too slow.
– Tools without people would have left the client confused and exposed.
The Takeaway for Construction Businesses
Cyber threats don’t always come from hackers targeting your company directly. Often, they arrive disguised as helpful tools, support software, or routine downloads. The difference between a near miss and a major incident is visibility, speed, and layered defense.
Spot Migration doesn’t just react to threats: we build security into the foundation of every client relationship. In this case, that proactive mindset stopped a critical incident before it ever had the chance to become one.
If you’re trusting your business to a single security tool, this story is your warning. If you’re working with Spot Migration, it’s your reassurance.
