Huntress reported real-world attacks where criminals used social engineering to get victims to install or run remote support tools, then deployed modified (rogue) ScreenConnect clients. After gaining control, the attackers ran scripts to recon the system, stage additional payloads, and spread the same malicious chain to other endpoints connected via ScreenConnect.
This campaign began with social engineering rather than a technical exploit. In one documented case, an attacker posed as tech support and instructed the victim to open Windows Quick Assist, a built-in remote support tool, giving the attacker control of the machine. On the same day, the same VBScript files were seen deployed in another environment, likely through a phishing message rather than a phone call.
Once a rogue ScreenConnect client was installed, it spawned repeated Windows Script Host (wscript.exe) processes to run four VBScript files from the ScreenConnect temporary directory, with an additional VBScript added for persistence. These scripts performed reconnaissance, staged further payloads, and executed PowerShell. A follow-on PowerShell script attempted a UAC bypass and cleaned up evidence of the intrusion.
What made this campaign notable is how it propagated. Rather than stopping at the initial victim, the attackers used ScreenConnect's own connectivity to push the identical staged chain to other endpoints already connected through the tool. This let a single successful social engineering attempt cascade across multiple machines without needing a fresh phishing lure or call for each new victim.
The attack relied on trust in familiar remote support workflows. A phone call claiming to be tech support, paired with a request to open a legitimate Windows tool like Quick Assist, does not look like an attack to most users. Because the victim initiated the remote session themselves, the malicious activity that followed had a much easier path into the environment.
Organizations should train employees to treat unsolicited tech support outreach as suspicious and to verify any remote access request through a known internal channel before allowing control of their machine. Staff should also understand that a remote session can be used to run malicious scripts, and should report it immediately if a supposed helper starts running scripts or command windows. IT administrators managing ScreenConnect should apply extra scrutiny to on-premises installations for unauthorized changes or rogue clients, and consider disabling file transfer functionality as an added precaution.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
In at least one case, an attacker posed as tech support and convinced the victim to open Windows Quick Assist, which gave the attacker remote control of the machine. A related incident on the same day involved the same VBScript files being deployed, likely through phishing.
It spawned repeated wscript.exe processes to run four VBScript files plus an additional VBScript for persistence, performed reconnaissance, staged payloads, ran PowerShell, and attempted a UAC bypass while cleaning up evidence.
The campaign used existing ScreenConnect connectivity to push the same staged script chain to other endpoints connected through that tool, giving it worm-like propagation.
ConnectWise issued an advisory about an issue affecting ScreenConnect file transfer behavior and recommended disabling file transfer functionality until a fix is released.
Imagine this: someone calls, says they're tech support, and asks you to open Windows Quick Assist so they can 'fix' your PC. In a real August 20 attack, the caller did exactly that. Once in through Quick Assist, they dropped a rogue ScreenConnect client that started spawning wscript.exe and multiple VBScript files in the ScreenConnect temp folder. Those scripts ran recon, staged more payloads, kicked off PowerShell to try a UAC bypass, wiped traces, and then used ScreenConnect to push the same malicious chain to other connected machines, like a worm riding your remote support tool. Here’s the move: if anyone you didn’t contact first asks you to open Quick Assist, ScreenConnect, or any remote tool, hang up and call our official IT number to verify before you share control.
Microsoft reported real phishing campaigns that trick users into running a legitimate MSP360 remote-management installer disguised as meeting invites, PDFs, and software updates. After MSP360 is installed, attackers use it to silently install ScreenConnect as a second remote-access path, then use…
Cybercriminals sent emails styled like Bank of America that redirected victims to fake pages and pushed a download called “Account Guard.” On Windows, the download installed ScreenConnect remote management software, giving attackers remote control of the device. The campaign used lookalike domains…
Researchers describe real-world “ClickFix” social-engineering lures that trick people into installing malware by downloading fake apps (like Spotify/Zoom/Teams) or copying commands into Terminal. One campaign abused a compromised, verified HBO Max Reddit account to run malicious ads, while another…
Attackers used a fake Cloudflare “verify you are human” overlay to copy a command to victims’ clipboards and trick them into pasting it into Windows Terminal/PowerShell. The command kicked off a multi-stage infection chain, including downloading payloads hidden inside PNG images, establishing…
Huntress reports attackers are increasingly installing legitimate remote monitoring and management (RMM) tools after a phishing click, giving them persistent remote control that can blend in with normal IT activity. The article also describes common identity-focused schemes like hidden mailbox…
Attackers are using sponsored Google ads to route people to a malicious “custom GPT” that looks like ChatGPT, even while the user is logged in on the real ChatGPT domain. The fake GPT displays a convincing “service availability” message and pushes a link to a “backup domain” that ultimately…
