Hackers Weaponize ScreenConnect to Spread Worm

Cybersecuritynews •Tushar Subhra Dutta • September 3, 2026

Hackers are turning rogue remote-support installations into a tool that can spread malicious code between Windows computers. The activity stands out because an infected remote-access client can pass staged payloads to connected systems, widening an intrusion without a lure for every victim. The campaign began with social engineering, including fake technical-support interactions, phishing, and a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Rogue ScreenConnect Clients Spread Malware Like a Worm Huntress has reported a wave of rogue ScreenConnect installations that spread malware across Windows systems without further action from victims or attackers. This self-propagating attack chain, resembling a worm, begins with social engineering tactics, such as fake tech-support calls. Once installed, the rogue clients execute a series of four VBScript files (1.vbs to 4.vbs) via the Windows Script Host, allowing them to profile the infected machine and deploy additional payloads. The modified ScreenConnect clients can automatically transfer these scripts to newly connected systems, facilitating further infections. Huntress has observed this behavior across multiple unrelated organizations, indicating a widespread issue. The campaign is ongoing, and Huntress is in communication with ConnectWise regarding the situation. 10 sources 71

Extracted Entities

Hackers Weaponize ScreenConnect to Spread Worm

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)