Attackers use rogue ScreenConnect clients to spread malware

A file transfer flaw in ScreenConnect Remote Access Support and Access sessions affects both Cloud and On-Premise deployments, ConnectWise confirmed.

“A CVE identifier and an official fix will be issued within the week,” the company wrote in its September 3 advisory.

ScreenConnect is a popular remote support and access solution tailored for IT departments and managed service providers (MSPs). The platform can be hosted by ConnectWise (in their cloud) or self-hosted by organizations (on-prem or in their own private cloud).

Until a fix is available, ConnectWise recommends that partners disable file transfers for technicians.

Administrators can do this by going to Administration > Security > Roles, editing each assigned role, and reviewing the permissions for each session group. If TransferFiles, or TransferFilesInSession on legacy versions, is enabled, it should be deselected. The change must be applied to each applicable role.

“This setting change does not require a version upgrade and can be applied immediately,” ConnectWise stated.

The advisory follows research from cybersecurity company Huntress describing how rogue ScreenConnect clients spread malware to every new machine that connects to them.

Every incident began with social engineering that led to rogue ScreenConnect instances being deployed on victims’ machines, something Huntress said is fairly typical, since “RMM abuse is a top attack vector” the company has tracked over the past year.

After the rogue instances landed, the clients began spawning repeated Windows Script Host processes, flagged as abnormal behavior, to deploy four VBScript files named 1.vbs through 4.vbs. Attackers were also seen creating a Windows registry Run Key named WindowsServiceHost, pointing to a matching script file in the affected user’s AppData directory.

“An analysis of the payloads used in the attack revealed a staged attack designed to profile hosts and conceal activity. Perhaps the most interesting part of the attack chain was that it used modified ScreenConnect clients to propagate the VBScript chain (specifically executing the four files (1.vbs to 4.vbs) to connected ScreenConnect endpoints, creating worm-like spread across newly connected systems,” the researchers noted.

The scripts were used for system discovery and to retrieve or launch additional components. Huntress documented payloads associated with persistence, additional ScreenConnect installations, tunneling, security-control changes, and cryptocurrency mining.

Huntress advises checking ScreenConnect audit logs for RunFiles or RanFiles entries tied to a guest process, and recommends reimaging any machine already showing signs of compromise from known-good media.

“From our conversations with ConnectWise and our current understanding of the risk, we suggest admins apply extra scrutiny to any on-premises ScreenConnect installations you may have within your environment,” Huntress added.

UPDATE (September 7, 2026, 08:45 a.m. ET):

ConnectWise has not confirmed a technical link between the file transfer flaw and the rogue ScreenConnect campaign Huntress described. This article has been edited to point out that.