Email bombing and external Teams chats used for remote access
Arctic Wolf reports the pattern in more than 400 incidents, with Quick Assist most often used before credential theft.
68
Product
ScreenConnect
- Mentions · 7d6
- Mentions · 30d12
- All mentions33
- First seenAug 31, 2026
- Last mentioned3d ago
Timeline
33 articles · newest firstSpam floods precede fake IT-support chats in Microsoft Teams
Arctic Wolf documented more than 400 cases; remote-access tools can be installed in under 15 minutes, sometimes leading to ransomware.
64
Attackers abuse Teams external chat to breach organizations quickly
Arctic Wolf saw more than 400 cases, often with email bombing and Quick Assist, and did not name the operators.
76
Fake Microsoft Teams IT support used for remote access and malware
Arctic Wolf tied more than 400 cases to external chats, inbox floods, and tools such as Quick Assist, sometimes within 15 minutes.
76
Attackers impersonate IT support on Microsoft Teams to gain remote access
An October 26 Arctic Wolf report on more than 400 incidents also describes a PowerShell and MSI infection chain.
76
Teams IT-support impersonation used to deploy malware and ransomware
Arctic Wolf ties hundreds of cases to throwaway Microsoft 365 tenants, mail bombing, RMM tools, and sometimes Chaos ransomware.
74
Malicious calendar invites surge, stealing Microsoft logins and pushing ScreenConnect
Check Point counted more than 740,000 such emails in the first two weeks of October, up from a few thousand a month in April.
66
What Cybersecurity Leaders Must Prioritize in 2027
Huntress urges leaders to prioritize RMM abuse, AI-enabled crime, social-engineering loaders, and multi-extortion ransomware.
32
Microsoft Power BI Phishing Campaign Deploys Rogue ScreenConnect RMMs for Persistent Access
Huntress found a Power BI phishing campaign that installs rogue ScreenConnect clients for persistent Windows access.
62
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
Huntress reports phishing that abuses Microsoft Power BI links to install rogue ScreenConnect RMM clients.
61
Hackers Abuse Legitimate ScreenConnect Tool to Gain Remote Access Through Phishing
Phishers sent a fake payment notice that installed a legitimate ScreenConnect client aimed at their server.
54
ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st)
Attackers phish victims into running a signed ScreenConnect client that calls an attacker instance.
50
Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks
Phishing campaigns abuse signed MSP360 installers to deploy ScreenConnect and establish dual remote-access footholds.
66
US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access
US-focused CSuite phishing steals Microsoft 365 sessions and installs RMM tools for persistent access.
72
Major Cyber Attacks in September 2026: US Organizations Face Session Theft, Remote Access, and Payment Fraud
September campaigns CSuite, N0va, and IronToll phished US organizations for Microsoft 365 sessions, tokens, and payment data.
70
Crooks use fake desktop apps to fool HR staff into giving them remote access
Attackers impersonate US HR and payroll vendors with fake desktop apps that silently install ConnectWise ScreenConnect.
58
Fake payroll desktop apps hand attackers a route to company paychecks
Fake payroll desktop apps silently install ScreenConnect, giving one operator a path to company paychecks.
58
CSuite Targets US and EU Organizations with Device-Code Phishing and Remote Access
CSuite targets US and EU organizations with device-code phishing and remote access. 60% of identified victims are US-based; 351 related sandbox analyses detected; 23 modules in the phishing panel.
90
CISA Warns of Critical ScreenConnect Vulnerability Actively Exploited in Attacks
CISA added actively exploited ConnectWise ScreenConnect flaw CVE-2026-84869 to the KEV catalog, setting a September 14 patch deadline.
85
Critical ScreenConnect flaw now actively exploited in attacks
CISA confirms active exploitation of critical ConnectWise ScreenConnect flaw CVE-2026-84869, ordering federal agencies to mitigate within three days.
82
ConnectWise patches critical ScreenConnect authentication failure after five days
ConnectWise patched ScreenConnect flaw CVE-2026-84869 five days after warning files could be transferred and executed via active sessions without authorization.
66
ConnectWise security advisory (AV26-903)
ConnectWise patches ScreenConnect CVE-2026-84869, reported exploited in the wild; administrators should update to 26.6.5.
72
Grand Theft Auto VI hype leads to malware
Fake GTA6 ISO downloads spread via SEO poisoning, torrents, and forums deliver NJRAT, DCRAT, an infostealer, and wiper ransomware.
45
Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence
Phishing emails with browser-in-the-browser fake Adobe pages trick users into installing rogue ScreenConnect clients granting persistent remote access.
52
Attackers Use Multi-Hop Google Redirects for Phishing Campaign
Threat actors chain multiple legitimate Google service redirects to evade detection and deliver credential harvesting or ScreenConnect remote access tooling.
48
Modified ScreenConnect Clients Used in Worm-Like Campaign
Huntress warns of worm-like attacks using modified ScreenConnect clients to spread VBScript payloads; ConnectWise issued an advisory.
66
Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts
Huntress says rogue ScreenConnect clients spread a four-stage VBScript chain delivering backdoors, privilege-escalation tools, or an XMRig miner to newly connected hosts.
72
ConnectWise warns of new ScreenConnect flaw without patch
ConnectWise warns of an unpatched ScreenConnect flaw affecting file transfer in support sessions and shares interim mitigations for MSPs.
60
Attackers use rogue ScreenConnect clients to spread malware
Attackers deploy rogue ScreenConnect clients that spread VBScript malware to newly connected machines while ConnectWise patches a file-transfer flaw.
76
ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories
Microsoft warns of Teams IT-impersonation intrusions deploying Node.js implants; Spring Ring vishing hit 150+ employees across 10 companies; The Gentlemen ransomware claims 683 victims.
72
Release Notes: Faster TI Investigations, Fresh Threat Research, and 650+ Threat Coverage Updates
ANY.RUN August release adds TI Lookup connections view, 81 behavior signatures, 16 YARA rules, 559 Suricata rules, and three new threat intelligence reports.
28
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.
78
Daisy-Chaining Trust: Investigating Faronics Deploy Abuse
Actors abuse Faronics Deploy in phishing campaigns to run PowerShell and deploy ScreenConnect while evading detection with trusted tools.
55
Related CVEs
by mentions- CVE-2026-84869<1%9.9Missing authorization in ScreenConnect client allows unauthorized file execution
- CVE-2024-1709100%10.0Authentication Bypass in ConnectWise ScreenConnect Creates Rogue Admin Accounts
- CVE-2025-39354%7.2ViewState Code Injection in ConnectWise ScreenConnect May Lead to RCE
- CVE-2026-3564<1%9.0A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain…
Appears with
- ConnectWisevendor · 18
- Microsoftvendor · 15
- Quick Assistproduct · 8
- Microsoft Teamsproduct · 7
- AnyDeskproduct · 6
- Huntressvendor · 6
- ConnectWiseorganization · 6
- Huntressorganization · 6
- Arctic Wolforganization · 5
- Googlevendor · 4
- Ateraproduct · 4
- Microsoft 365product · 4
- Adobevendor · 3
- Action1product · 3
- ScreenConnectvendor · 3
- Chaosmalware · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.