Researchers found three real-world incidents where attackers tricked users into installing or running remote access tools, then used a four-step VBScript chain to deliver additional payloads. After installation, the rogue ScreenConnect client could spread the same scripts to newly connected hosts, creating “worm-like” propagation over remote support sessions.
Researchers documented three unrelated incidents that each used a different lure to get a rogue ScreenConnect client installed on a victim machine. One involved a tech support scam that persuaded a user to run Quick Assist, another delivered an MSI installer through phishing, and a third used a fake Geek Squad refund form that led to downloading and running an executable. In all three cases, the end result was the same: a ScreenConnect client under attacker control was installed on the host.
Once installed, the rogue client repeatedly executed a four-stage VBScript chain (1.vbs through 4.vbs) via wscript.exe. This chain profiled the host and delivered payloads that varied based on the results, including a ScreenConnect backdoor, UAC bypass and persistence tooling, tunneling utilities, and a cryptocurrency miner.
Each pretext exploited a moment where a user believed they were getting help or resolving a problem: a support call, an expected-looking installer, or a refund process. None of the lures required advanced technical deception, just enough plausibility to get the user to launch a tool or run a file. Because ScreenConnect is a legitimate and widely used remote support tool, its presence on a machine does not automatically raise suspicion, which helped the rogue installations blend into normal IT activity.
The worm-like spread mechanism is a key detail: connecting to an infected ScreenConnect client could cause a newly connected host to receive and execute the same script chain, extending the compromise beyond the original victim.
These incidents show that remote support tools, while useful for legitimate IT work, can be repurposed by attackers when initial access is gained through simple social engineering. Recognizing the common thread across tech support scams, phishing installers, and fake refund pages can help employees and IT teams catch these attempts before a rogue client gets a foothold.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Three separate incidents used a Quick Assist tech-support scam, a phishing email with an MSI installer, and a fake Geek Squad refund form to trick users into installing or running the client.
Once a rogue ScreenConnect client was installed, connecting to it could cause a newly connected host to receive and execute the same four-stage VBScript chain, allowing the infection to propagate over remote support sessions.
Depending on host profiling results, attackers delivered a ScreenConnect backdoor, UAC bypass and persistence tooling, tunneling utilities, or a cryptocurrency miner.
Awareness guidance includes verifying unsolicited tech support requests through official channels, avoiding installation of software from unexpected emails, treating executable-based refund processes as suspicious, and limiting file transfer permissions on remote support tools.
Imagine this: you let “tech support” in once, and their ScreenConnect session quietly spreads to every machine they remote into after you. Researchers saw three real cases: a fake Quick Assist support call, a phishing email with ScreenConnect.ClientSetup.msi, and a bogus Geek Squad refund page. All ended with a rogue ScreenConnect client running a four-step VBScript chain named 1.vbs through 4.vbs over wscript.exe. Here’s the nasty part: once that rogue ScreenConnect is in, any system that connects to it can be fed the same VBScript chain, worm-like. Depending on a hidden state value like 000 or 011, it can drop a ScreenConnect backdoor, UAC bypass tools, tunneling utilities, or even a crypto miner talking to sites like tele-sync.opik.net or 131.123.40.98:8041. Your move: if anyone you didn’t contact tells you to open Quick Assist or install ScreenConnect.ClientSetup.msi, stop and verify through our official support channel before you click anything.
This weekly roundup includes multiple real-world social-engineering and phishing-style operations, including fake recruiter outreach pushing malicious Android apps, phishing emails that trick users into installing remote management tools, and vishing that reportedly led to compromised Okta…
Researchers say the Iran-linked group Nimbus Manticore posed as recruiters on LinkedIn and job platforms to send developers “technical challenge” ZIP files that secretly installed cross-platform remote access trojans. The lures used urgency (short test windows) and realistic developer workflows…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
This weekly roundup includes real-world social engineering campaigns, including scammers mailing fake IRS letters to cryptocurrency holders and a phishing campaign impersonating Bank of America. The lures are designed to pressure victims into visiting a bogus compliance portal or installing remote…
Microsoft says a Russian-linked group is abusing hotel and conference Wi‑Fi “captive portals” to trick travelers into entering corporate credentials or installing malware. Victims see what looks like a normal Wi‑Fi login flow, but attackers manipulate DNS/website traffic to redirect them to fake…
Researchers describe an active campaign ("SMOKE#SCREEN") where attackers trick users with realistic software update and document-themed lures to install a legitimate remote-control tool (ScreenConnect). Once installed, the attacker gains persistent remote access that can look like normal IT…
