Why Did That Remote Tool Come Back? How to Tell If Someone Else Enrolled Your Office PC
By Dane Gray
Your IT provider removes a remote-support program that nobody asked for. Later that day, it's back. Same program, same computer.
That isn't a glitch. Security researchers recently described attacks where a phishing email tricks someone into signing their work PC up to a device management account the attacker controls. Once that happens, the attacker can push software to the PC whenever they like, including remote-control tools. Remove the tool, and they simply send it again.
This guide is for the people who actually sit at those computers: office managers, front desk staff, bookkeepers, and owners. No technical background needed.
What is device management, and why would an attacker want it?
Businesses use device management tools to look after their computers from one place. IT can install approved apps, push updates, and apply security settings without walking to every desk. It's useful, and it's normal.
The problem is that these tools are trusted. When a PC is enrolled, the management account behind it gets a privileged path into that computer. If a criminal owns that account, they get the same path. Nothing about it looks like a virus, because the software itself is legitimate. It's just pointed at the wrong boss.
How does a PC end up enrolled by a stranger?
Researchers described two lures that worked:
A fake e-signature installer. The target got emails with subjects like "Official Invitation to Submit Proposal" and "Review Required," naming a business they likely worked with. A link downloaded a file named to look like an installer for a well-known e-signature service. It actually installed a device management app linked to the attacker. A remote-support tool showed up soon after.
A fake Teams meeting invite. A receptionist opened an email about a tax planning inquiry. The link looked like a Microsoft Teams meeting invitation and led to a page titled "Calendar." Behind the scenes, that page enrolled the PC in the attacker's management account, which then installed its own agent and, after that, a remote-control tool.
Notice what's missing: no strange attachment with a scary name and no obvious virus warning. Just ordinary business requests, a proposal, a signature, a meeting.
Why does removing the remote tool not fix it?
Because the remote tool is not the real problem. It's the delivery. The management enrollment is still there, so the attacker can push the tool again. In the case researchers described, the IT provider removed the remote tool, and the same tool came back later and connected to the same attacker.
The fix is to remove the enrollment itself, then deal with anything the attacker could have touched while they had access. That's a job for your IT provider, not for staff.
How can I tell if my office PC was enrolled by someone else?
You can do these checks yourself on a Windows PC. They're look-only. Don't remove or disconnect anything yourself.
1. Look at Access work or school.
Open Settings > Accounts > Access work or school. You'll see any work accounts and management connections on the PC. If your business uses Microsoft 365, you'll usually see your own work email here. Write down anything you don't recognize, especially names of companies you don't work with.
2. Look for remote-support apps nobody asked for.
Open Settings > Apps > Installed apps and scroll through the list. Remote-support tools often have words like "remote," "connect," "support," "desktop," or "control" in their names. If your IT provider uses one, they can tell you which one. Anything else is worth asking about.
3. Think back on odd install prompts.
Did a document-signing link, a meeting invite, or a proposal request ever ask you to download and run something? Signing a document or joining a Teams meeting in a browser shouldn't require installing a program you weren't expecting.
4. Notice signs that something else is in charge.
A message saying "Some settings are managed by your organization" on a computer your IT provider says isn't managed, new apps appearing on their own, or the mouse moving when you're not touching it are all worth a call.
What should I do if something looks wrong?
Stop and call your IT provider. Use a phone number you already have, not one from the email or a pop-up.
Then:
Don't click anything else in the suspicious email, and don't delete it. Your IT provider may need it.
Don't try to remove the app or the account yourself. Pulling one piece can tip off the attacker, and it doesn't remove the enrollment behind it.
Write down what you saw: the email subject, what you clicked, and anything you noticed on screen.
Leave the PC on unless your IT provider tells you to unplug it from the network.
For your IT provider, the cleanup researchers recommend includes isolating the computer, removing it from the unauthorized management account, signing out active sessions, resetting passwords, and rebuilding the PC if they can't confirm it's clean.
Why does this matter for your Microsoft 365 accounts?
A remote-control tool on a PC sees whatever the person at that PC sees. That includes an open Outlook, Teams, and any Microsoft 365 session already signed in. So a rogue install on one desk can turn into an account problem fast.
That's where identity threat detection and response (ITDR) fits. Device tools watch the computer. ITDR watches what the account does after sign-in: new inbox rules, risky sign-ins, sessions that don't look right. If an attacker uses a hijacked PC to get into email, that's the activity ITDR is built to spot and contain. You can read how that works step by step on our ITDR page.
How do I keep this from happening in the first place?
Two lines on our Security Baseline do most of the work here:
No everyday admin rights. If staff can't install software on their own, a fake installer has a much harder time doing anything. When someone genuinely needs a program, they request it and IT approves it. That's "elevation on demand instead of standing admin rights."
Device management you control. Your IT provider should keep a list of which management tools, accounts, and remote-support tools belong on your computers, and treat anything else as a security event, not a routine install.
A few habits help too:
Be suspicious of "install this to sign" or "install this to join." Real document-signing and meeting links open in a browser.
Verify unexpected proposals, signature requests, and meeting invites with the sender, using contact details you already have.
Ask your IT provider one question: "If a remote tool we didn't approve showed up on a PC, would you know, and would you check how it got there?" The second half of that question matters most.
If an incident does expose client or employee data, the notice rules may apply. Our guide to Texas data breach notification deadlines explains what that means.
Frequently asked questions
Why does a remote access tool keep reinstalling on my computer?
One common reason is that the PC was enrolled in a device management account someone else controls. That account can push the tool back after it's removed. Your IT provider needs to remove the enrollment itself, not just the tool.
How do I check if my work computer is managed by someone else?
On Windows, open Settings > Accounts > Access work or school and look for accounts or organizations you don't recognize. Then check Settings > Apps > Installed apps for remote-support tools you didn't ask for. Report anything unfamiliar to your IT provider.
Can a fake e-signature or Teams link really take over my PC?
It can start the process. In the cases researchers described, a fake e-signature installer and a fake Teams meeting page led to the PC being enrolled in an attacker's management account, which then installed remote-control software.
Should I uninstall the strange app myself?
No. Leave it, write down what you saw, and call your IT provider. Removing pieces yourself can destroy evidence and won't remove the enrollment behind it.
Does ITDR stop this kind of attack?
ITDR focuses on Microsoft 365 accounts rather than the PC itself. It helps if the attacker uses the hijacked PC to get into email or other accounts. Preventing the install in the first place comes from limiting admin rights and controlling device management.
Not sure what's on your office PCs?
At 24uNet, we help businesses in Bryan–College Station and across Texas keep admin rights tight, know exactly which tools are allowed on every computer, and watch Microsoft 365 accounts for signs of takeover. Start with our Security Baseline, or see how we handle account takeovers on our ITDR page.
This article is general security information, not a substitute for your IT provider's review of your specific computers.
Comments