Hackers Weaponize ScreenConnect to Spread Worm-Like Malware Across Windows Systems

Hackers are turning rogue remote-support installations into a tool that can spread malicious code between Windows computers.

The activity stands out because an infected remote-access client can pass staged payloads to connected systems, widening an intrusion without a lure for every victim.

The campaign began with social engineering, including fake technical-support interactions, phishing, and a fraudulent refund search. Victims granted remote access or ran an installer, letting attackers place an unauthorized client on the device.

The approach uses trust and normal support workflows, not a software flaw. Huntress researchers identified the pattern across unrelated organizations during critical incidents in late August.

The repeated behavior suggests a coordinated operation, not isolated abuse, and shows how a trusted administration tool can become a delivery channel once an attacker controls its client.

The danger is not limited to the first computer. The malware profiles the host, attempts to avoid systems with certain security tools, establishes a way to return after a restart, and can deliver additional tools.

Huntress said in a report shared with Cyber Security News (CSN) that in its more capable path, the operation can elevate privileges, weaken Windows protections, tunnel traffic, and run a cryptocurrency miner.

Since remote sessions often look legitimate, the activity can blend into routine administration until investigators identify unexpected script executions on affected endpoints.

Hackers Weaponize ScreenConnect

The altered ScreenConnect clients repeatedly launched Windows Script Host to run a four-stage script chain. The early stages checked the machine and prepared encrypted follow-on content; later stages selected a payload based on the results.

A previous report on fake Adobe download attacks shows why unauthorized remote-access deployments deserve the same urgency as conventional malware.

The most unusual element appeared in recovered modified clients. When a new host session came online, the client packaged the staged scripts through ScreenConnect’s file-transfer feature and marked them to run on the connected machine.

That turns ordinary remote connections into an infection route and gives the activity its worm-like character. The code tracked connection identifiers to avoid sending the payload repeatedly during an active session.

It removed those records after a disconnect, however, meaning that reconnecting the same system could trigger the delivery chain again. This differs from a one-time remote-support compromise because new connections can extend the attacker’s reach.

One branch installed a concealed remote-access client with elevated rights, while another included a tunnel and mining software.

This mirrors broader abuse of remote-management tools for hands-on control, seen in recent ScreenConnect abuse reports. The tool is not malware, but an attacker-controlled installation gives outsiders a durable foothold.

Social engineering opens the door

These incidents show how a persuasive call, message, or download can lead to an endpoint compromise. In one case, the victim used Windows Quick Assist after a technical-support scam. In another, a phishing lure led to a downloaded installer.

Similar tactics have appeared in Teams Quick Assist attacks, where attackers pose as support staff to obtain interactive access.

The organizations should reimage affected hosts from known-good media or perform a clean operating-system installation.

Administrators should also closely review on-premises ScreenConnect deployments, rather than assuming that a remote-support client is authorized because it uses a familiar name.

The researchers specifically urged defenders to treat server audit-log entries showing remote file-execution actions from a guest process as suspicious when they reference the staged scripts.

They also warned that filenames may change, so security teams should investigate unusual Windows Script Host or PowerShell activity tied to a ScreenConnect session.

Coverage of a critical ScreenConnect security flaw offers further context on why prompt review and patching matter for remote-control infrastructure.

For users, the immediate lesson is simple: do not share remote-control codes or run support software after an unsolicited contact, pop-up, or search result.

Organizations should establish legitimate support channels, restrict remote-management software installation, and isolate suspected devices before connected systems are exposed and further damage occurs quickly across the organization.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Weaponize ScreenConnect to Spread Worm-Like Malware Across Windows Systems appeared first on Cyber Security News.