Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence
Phishing emails with browser-in-the-browser fake Adobe pages trick users into installing rogue ScreenConnect clients granting persistent remote access.
52
Vendor
ScreenConnect
- Mentions · 7d0
- Mentions · 30d0
- All mentions4
- First seenAug 19, 2026
- Last mentionedSep 9, 2026
Timeline
4 articles · newest firstAttackers Use Multi-Hop Google Redirects for Phishing Campaign
Threat actors chain multiple legitimate Google service redirects to evade detection and deliver credential harvesting or ScreenConnect remote access tooling.
48
ConnectWise warns of new ScreenConnect flaw without patch
ConnectWise warns of an unpatched ScreenConnect flaw affecting file transfer in support sessions and shares interim mitigations for MSPs.
60
Medusa ransomware gang has hit over 500 organizations, CISA warns
FBI, CISA, and HHS warn Medusa ransomware has hit over 500 organizations across critical infrastructure since June 2021, using phishing and unpatched flaws.
75
Related CVEs
by mentions- CVE-2024-1709100%10.0Authentication Bypass in ConnectWise ScreenConnect Creates Rogue Admin Accounts
- CVE-2025-39354%7.2ViewState Code Injection in ConnectWise ScreenConnect May Lead to RCE
- CVE-2026-3564<1%9.0A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain…
Appears with
- ScreenConnectproduct · 3
- CISAorganization · 2
- Shadowserverorganization · 1
- BeyondTrustvendor · 1
- RingCentralorganization · 1
- Huntressvendor · 1
- Googleorganization · 1
- ConnectWiseorganization · 1
- ConnectWisevendor · 1
- Shadowservervendor · 1
- Adobevendor · 1
- SimpleHelpproduct · 1
- FBIorganization · 1
- HHSorganization · 1
- Medusathreat actor · 1
- AnyDeskproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.