On February 10, 2026, Microsoft Threat Intelligence documented a coordinated IRS-impersonation phishing campaign that reached 29,000 users across 10,000 organizations in a single day, with financial services, technology, and retail sectors bearing the highest exposure. Attackers used industrialized phishing-as-a-service platforms to harvest credentials, then deployed legitimate remote management tools (ConnectWise ScreenConnect, Datto RMM, SimpleHelp) to establish persistent access that bypasses standard endpoint controls. The business risk is significant: compromised RMM access grants attackers the same trusted foothold as internal IT staff, enabling data exfiltration, ransomware staging, or prolonged undetected presence across the enterprise.