ScreenConnect (Organization): news timeline & CVEs

Attackers Abuse Legitimate ScreenConnect Client in Phishing Campaign to Gain Remote Access

Phishers deliver a legitimately signed ConnectWise ScreenConnect client preconfigured to call back to attacker infrastructure, bypassing malware detection for remote access.

An invoice-themed phishing email (subject 'EFT Wire Transfer', fake $5,745.65 payment pretext) directed victims via a hyperlink to a ScreenConnect.ClientSetup.exe hosted on thelittlecupandsaucer.com.au. The executable was an authentic ScreenConnect client validly signed by ConnectWise, LLC through DigiCert G4 Code Signing CA1, but configured to contact the attacker-operated relay instance-v2e2-relay.screenconnect.com over TCP 443 (instance v2e3e2), granting remote desktop control after execution. Microsoft confirmed no ScreenConnect vulnerability was exploited and separately documented phishing-delivered MSP360 installers used to deploy ScreenConnect as a second remote-access channel for file transfer, payload execution, and credential access. Attackers have similarly abused AnyDesk, TeamViewer, LogMeIn, BeyondTrust, Zoho Assist, Remote Utilities, NetSupport Manager, and SimpleHelp.

GBHackersupdated Oct 7, 13:00 UTC · 1d agofirst Oct 5, 05:50 UTC · 3d agoPhishing & fraud in the wild 3 sources1

How RMM abuse gives attackers a way in that looks like business as usual

Huntress reports attacker RMM abuse in 45% of Q1 2026 endpoint incidents, up 277% YoY, delivered via phishing lures stacking multiple remote-access tools.

Huntress found attackers abusing legitimate remote monitoring and management (RMM) software in 45% of endpoint-related incidents in Q1 2026, a category that grew 277% year over year in 2025 and sits 'one hop from ransomware or data theft.' In one case a fake service agreement installed Tiflux, after which the intruder stacked UltraVNC, Splashtop, and ScreenConnect on the same device for redundant access. Identity attacks were also ranked: mailbox manipulation made up 19% of identity-based threats in 2025 (24.6% of 2026 signals so far), AiTM session-token theft 18.9%, and device code phishing rose 1,380% between measured periods, with the EvilTokens kit hitting 344 organizations across five countries in 16 days. FakeAgent abused a malicious Claude Artifact on the real claude.ai domain to push SectopRAT to 29 organizations in two days, and ClickFix accounted for 53.2% of malware loader activity in 2025.

Help Net SecurityOct 5, 04:30 UTC · 3d agoThreat actor in the wild1

Rogue RMM Abuse: How Attackers Exploit Remote Access Tools

Huntress details phishing campaigns installing rogue ITarian and ScreenConnect RMM clients with SYSTEM persistence, amid a 277% spike in RMM abuse.

Huntress SOC investigated three incidents where phishing lures (a TransferXL secure-document email and fake ScreenConnect document shares) tricked employees into installing rogue RMM clients. Attackers stacked ITarian plus ScreenConnect for redundant SYSTEM-level persistence, ran defense-evasion binaries such as HideUL_x64.exe, and in one case used a client hidden for five months to set malicious inbox rules. Huntress tracked a 277% spike in RMM abuse in 2025 and now sees it in roughly 40% of incidents it investigates.

HuntressSep 23, 12:00 UTC · 15d agoThreat actor in the wild

ScreenConnect

Timeline3 articles

Appears with

Attackers Abuse Legitimate ScreenConnect Client in Phishing Campaign to Gain Remote Access

How RMM abuse gives attackers a way in that looks like business as usual

Rogue RMM Abuse: How Attackers Exploit Remote Access Tools