Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain in Worm-Like Campaign

Huntress warns that rogue ScreenConnect clients installed via tech-support scams — including Quick Assist abuse, phishing MSI installers, and fake Geek Squad refund lures — run a four-stage VBScript chain delivering backdoors, UAC-bypass tooling, and an XMRig…

Huntress identified three unrelated incidents in August 2026 in which attackers used social engineering — a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake Geek Squad refund form — to install rogue ScreenConnect clients. Each client repeatedly spawned wscript.exe to run four chained VBScript files (1.vbs through 4.vbs) that profiled the host, enumerated installed security products, and downloaded stage-specific payloads from Dropbox. Depending on the detected state, payloads included a user-level ScreenConnect backdoor, UAC-bypass privilege escalation tooling, or tunneling utilities bundled with an XMRig cryptocurrency miner. The PowerShell stage erased evidence, persisted via User Run Keys, and installed the UltraViewer remote desktop tool. Infected clients re-infected newly connected hosts, creating worm-like propagation across ScreenConnect sessions. ConnectWise published an advisory about a file transfer behavior issue affecting both cloud and on-premises ScreenConnect deployments, referencing a CVE identifier (not specified in either report) with a fix expected within a week; the company recommends disabling file transfer until the patch is released. Huntress recommends reimaging affected hosts.

• Huntress identified three unrelated incidents in August 2026; SecurityWeek reports the campaign began in late August
• Initial access used a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake Geek Squad refund form
• Rogue ScreenConnect clients repeatedly spawned wscript.exe to run four chained VBScript files (1.vbs through 4.vbs) for reconnaissance, staging, and PowerShell execution
• The scripts profiled hosts, enumerated installed security products, and downloaded stage-specific payloads from Dropbox
• Payload branches delivered a user-level ScreenConnect backdoor, UAC-bypass privilege escalation tooling, or tunneling utilities with an XMRig cryptocurrency miner
• The PowerShell stage erased evidence, persisted via User Run Keys, and installed the UltraViewer remote desktop tool
• Backdoored clients re-infected newly connected hosts, creating worm-like propagation over ScreenConnect sessions
• ConnectWise issued an advisory on a file transfer behavior issue affecting cloud and on-premises ScreenConnect, referencing a CVE identifier (not specified in reports) with a fix expected within a week