Huntress reported real-world attacks where criminals used social engineering to get victims to install or run remote support tools, then deployed modified (rogue) ScreenConnect clients. After gaining control, the attackers ran scripts to recon the system, stage additional payloads, and spread the same malicious chain to other endpoints connected via ScreenConnect.
This campaign began with social engineering rather than a technical exploit. In one documented case, an attacker posed as tech support and instructed the victim to open Windows Quick Assist, a built-in remote support tool, giving the attacker control of the machine. On the same day, the same VBScript files were seen deployed in another environment, likely through a phishing message rather than a phone call.
Once a rogue ScreenConnect client was installed, it spawned repeated Windows Script Host (wscript.exe) processes to run four VBScript files from the ScreenConnect temporary directory, with an additional VBScript added for persistence. These scripts performed reconnaissance, staged further payloads, and executed PowerShell. A follow-on PowerShell script attempted a UAC bypass and cleaned up evidence of the intrusion.
What made this campaign notable is how it propagated. Rather than stopping at the initial victim, the attackers used ScreenConnect's own connectivity to push the identical staged chain to other endpoints already connected through the tool. This let a single successful social engineering attempt cascade across multiple machines without needing a fresh phishing lure or call for each new victim.
The attack relied on trust in familiar remote support workflows. A phone call claiming to be tech support, paired with a request to open a legitimate Windows tool like Quick Assist, does not look like an attack to most users. Because the victim initiated the remote session themselves, the malicious activity that followed had a much easier path into the environment.
Organizations should train employees to treat unsolicited tech support outreach as suspicious and to verify any remote access request through a known internal channel before allowing control of their machine. Staff should also understand that a remote session can be used to run malicious scripts, and should report it immediately if a supposed helper starts running scripts or command windows. IT administrators managing ScreenConnect should apply extra scrutiny to on-premises installations for unauthorized changes or rogue clients, and consider disabling file transfer functionality as an added precaution.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
In at least one case, an attacker posed as tech support and convinced the victim to open Windows Quick Assist, which gave the attacker remote control of the machine. A related incident on the same day involved the same VBScript files being deployed, likely through phishing.
It spawned repeated wscript.exe processes to run four VBScript files plus an additional VBScript for persistence, performed reconnaissance, staged payloads, ran PowerShell, and attempted a UAC bypass while cleaning up evidence.
The campaign used existing ScreenConnect connectivity to push the same staged script chain to other endpoints connected through that tool, giving it worm-like propagation.
ConnectWise issued an advisory about an issue affecting ScreenConnect file transfer behavior and recommended disabling file transfer functionality until a fix is released.
Imagine this: someone calls, says they're tech support, and asks you to open Windows Quick Assist so they can 'fix' your PC. In a real August 20 attack, the caller did exactly that. Once in through Quick Assist, they dropped a rogue ScreenConnect client that started spawning wscript.exe and multiple VBScript files in the ScreenConnect temp folder. Those scripts ran recon, staged more payloads, kicked off PowerShell to try a UAC bypass, wiped traces, and then used ScreenConnect to push the same malicious chain to other connected machines, like a worm riding your remote support tool. Here’s the move: if anyone you didn’t contact first asks you to open Quick Assist, ScreenConnect, or any remote tool, hang up and call our official IT number to verify before you share control.
Cybercriminals sent emails styled like Bank of America that redirected victims to fake pages and pushed a download called “Account Guard.” On Windows, the download installed ScreenConnect remote management software, giving attackers remote control of the device. The campaign used lookalike domains…
Attackers used a fake Cloudflare “verify you are human” overlay to copy a command to victims’ clipboards and trick them into pasting it into Windows Terminal/PowerShell. The command kicked off a multi-stage infection chain, including downloading payloads hidden inside PNG images, establishing…
A campaign dubbed “TerminalFix” uses compromised websites to display fake Cloudflare CAPTCHA checks that instruct visitors to copy and run a PowerShell command. The goal is to get a user to run attacker-provided commands themselves, which can lead to persistent access and deeper intrusion into the…
Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run…
Ukrainian CERT says Sandworm-linked actors (UAC-0145) posed as recruiters to lure IT workers into a fake hiring process. Victims were guided from job-site chats to Telegram and Zoom, then emailed “VPN assessment” files that pushed a trojanized WireGuard-based VPN client capable of silently running…
A real, active phishing campaign impersonating Bank of America tricks victims into downloading a fake “Account Guard” that installs ScreenConnect remote access on Windows, while Mac users are redirected to a credential-stealing page asking for banking and identity details. Separately, Microsoft…
