Exploiting third-party remote access applications