Hijacked ScreenConnect Installs Are Spreading Malware Like a Worm, Huntress Warns

Huntress has identified a campaign of rogue ScreenConnect installations that spread malware in a worm-like fashion across unrelated customer environments. Attacks begin with social engineering — fake tech-support calls or bogus download pages — leading victims to install a backdoored ScreenConnect client. Once installed, four VBScript files (1.vbs–4.vbs) profile the machine, pull down payloads including backdoors, privilege escalation tools, and a crypto miner, and establish persistence via a fake 'WindowsServiceHost' registry entry. The most notable behavior: the rogue client monitors for new incoming remote-support sessions and automatically pushes the same VBScript bundle to any newly connected machine, meaning a legitimate help desk technician connecting to a compromised endpoint can inadvertently infect their own environment. Huntress recommends wiping confirmed infected machines, auditing ScreenConnect server logs for RunFiles/RanFiles entries from Guest processes, and treating any unexpected Windows Script Host or PowerShell activity tied to ScreenConnect sessions as a red flag. Indicators of compromise including file hashes and C2 infrastructure are included in the full report.

Source: https://www.itsecurityguru.org/2026/09/03/hijacked-screenconnect-installs-are-spreading-malware-like-a-worm-huntress-warns. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.