Attackers exploited a critical flaw in ConnectWise ScreenConnect and used social engineering to trick people into running a modified (rogue) ScreenConnect client. Once executed, the rogue client looked for active remote sessions and pushed VBScript files to connected systems to spread further. ConnectWise released an urgent patch (v26.6.5), and CISA added the issue to its Known Exploited Vulnerabilities list with a three-day federal patch deadline.
This incident combined a critical software vulnerability with a classic social engineering hook. Attackers exploited a flaw in ConnectWise ScreenConnect, tracked as a critical severity issue, that could allow files to be transferred and executed via an active remote session without authorization or host confirmation in certain circumstances. Rather than relying purely on the technical flaw, attackers used social engineering to trick victims into executing rogue ScreenConnect clients. Once a victim ran the modified client, it checked for active remote sessions and pushed VBScript payloads to connected targets, allowing the attack to spread in a worm-like manner across systems that shared remote support connections.
The attack succeeded because it targeted a tool that many organizations already trust and use routinely: remote support software. Employees, IT support staff, and MSP technicians are accustomed to installing or updating remote access clients as part of normal support workflows, which lowers suspicion when a request to run such software arrives. The observed incidents also involved deploying four VBScript files designed to establish persistence and propagate to other ScreenConnect clients, meaning a single successful execution could enable further spread without additional social engineering steps.
Defenders and end users should be alert to the following patterns:
Organizations relying on ScreenConnect or similar remote access tools should prioritize the following:
This case illustrates how a technical vulnerability and social engineering can reinforce each other, and why rapid patching combined with user awareness training around remote access requests remains essential for MSPs, IT services firms, and any organization using remote support tooling.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers exploited CVE-2026-84869, a critical ScreenConnect flaw with a CVSS score of 9.9 that allowed files to be transferred and executed via an active remote session without authorization or host confirmation in certain circumstances.
Attackers tricked victims into executing rogue ScreenConnect clients, which then searched for active remote sessions and pushed VBScript payloads to connected targets to spread further.
ConnectWise urges immediate patching to ScreenConnect version 26.6.5, and as a temporary mitigation recommends disabling the TransferFiles permission.
Managed service providers, IT services organizations, and any company using ScreenConnect for remote support are affected, with IT helpdesk staff and remote support users being primary targets.
You get an email: “Please run the attached ScreenConnect client to start the remote support session.” Looks routine, right? But this is a rogue ScreenConnect client abusing a critical bug, CVE-2026-84869. Once you run it, it quietly hunts for active ScreenConnect sessions and pushes VBScript files to every connected system, spreading like a worm. Here’s the tell: real IT never cold-emails you a ScreenConnect installer. If it didn’t come from our known IT portal or a ticket you opened, and they’re pushing you to ‘run it now to start the session,’ assume it’s fake. Your move: if you’re ever asked to install or run ScreenConnect and you didn’t request support, stop and contact IT using our normal helpdesk or chat, do not run the client from that email.
Researchers reported a real phishing operation spanning 46 countries that tricks people into installing legitimate remote monitoring and management (RMM) tools, giving attackers remote access that can look like normal IT activity. The lures use familiar business themes (tax documents, invoices,…
Huntress reported real-world attacks where criminals used social engineering to get victims to install or run remote support tools, then deployed modified (rogue) ScreenConnect clients. After gaining control, the attackers ran scripts to recon the system, stage additional payloads, and spread the…
A real phishing campaign is targeting DEF CON speakers and attendees through X/Twitter messages pretending to be a Coindesk executive. Victims are sent to a Google document that attempts a “click-fix” trick to get them to paste malicious commands into a terminal or download malware. The goal is to…
After Black Hat/DEF CON, cybercriminals allegedly targeted conference attendees by impersonating a CoinDesk executive over X direct messages. Victims were pushed into a realistic workflow using Google Docs and a fake Dropbox DocSend installer to trick them into running malware on macOS or Windows.
Researchers described a real scam where criminals called victims pretending to be bank support and convinced them to install a “legitimate” Android app. The app was actually SpyNote malware, giving the attacker remote control of the phone, after which a second tool (WindRelay) was used to relay…
Cybercriminals sent emails styled like Bank of America that redirected victims to fake pages and pushed a download called “Account Guard.” On Windows, the download installed ScreenConnect remote management software, giving attackers remote control of the device. The campaign used lookalike domains…
