Rogue Screen Connect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts

Summary: Huntress disclosed three unrelated incidents in August 2026 that used a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake Geek Squad refund form lure to install rogue ConnectWise ScreenConnect clients running a four-stage VBScript chain (1.vbs through 4.vbs). Once installed, the clients spawn wscript.exe to propagate the chain to newly connected hosts, record each ConnectionID to avoid repeat targeting, and remove that identifier on disconnect so a later reconnection triggers infection again.
Bottom line: The propagation runs over ScreenConnect's own trusted connections, so a technician connecting to an infected client can hand the four-stage chain to the server-side Host system, and the state value 011 branch disables Defender reporting, turns off memory integrity, and runs an XMRig miner. ConnectWise has issued an advisory covering Cloud and On-Premise deployments and recommends disabling technician file transfer until a fix is in place.

Read the original at The Hacker News ↗