Modified ScreenConnect Clients Used in Worm-Like Campaign
Huntress warns of worm-like attacks using modified ScreenConnect clients to spread VBScript payloads; ConnectWise issued an advisory.
66
Malware
rogue ScreenConnect client
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 7, 2026
- Last mentionedSep 7, 2026
Timeline
2 articles · newest firstRogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts
Huntress says rogue ScreenConnect clients spread a four-stage VBScript chain delivering backdoors, privilege-escalation tools, or an XMRig miner to newly connected hosts.
72
Appears with
- ScreenConnectproduct · 2
- ConnectWiseorganization · 2
- ConnectWisevendor · 2
- Huntressorganization · 2
- UltraViewerproduct · 1
- Quick Assistproduct · 1
- VBScript chainmalware · 1
- Huntressvendor · 1
- XMRigmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.