Rogue ScreenConnect Clients Spread Worm

Gbhackers •Mayura Kathir • September 3, 2026

A malicious ScreenConnect campaign in which rogue remote-access clients do more than provide attackers with hands-on control: modified clients can automatically push a multi-stage VBScript malware chain to newly connected Windows endpoints. Once deployed, the clients repeatedly spawned wscript.exe to execute four scripts 1.vbs, 2.vbs, 3.vbs, and 4.vbs from ScreenConnect-related temporary locations. The behavior is […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Rogue ScreenConnect Clients Spread Malware Like a Worm Huntress has reported a wave of rogue ScreenConnect installations that spread malware across Windows systems without further action from victims or attackers. This self-propagating attack chain, resembling a worm, begins with social engineering tactics, such as fake tech-support calls. Once installed, the rogue clients execute a series of four VBScript files (1.vbs to 4.vbs) via the Windows Script Host, allowing them to profile the infected machine and deploy additional payloads. The modified ScreenConnect clients can automatically transfer these scripts to newly connected systems, facilitating further infections. Huntress has observed this behavior across multiple unrelated organizations, indicating a widespread issue. The campaign is ongoing, and Huntress is in communication with ConnectWise regarding the situation. 10 sources 71

Extracted Entities

Rogue ScreenConnect Clients Spread Worm

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)