Hackers Are Hijacking Remote-Support Software to Spread Malware Across Whole Networks
A modified version of the popular IT tool ScreenConnect is being used in a self-spreading attack that starts with a fake tech-support call and ends with criminals inside your entire network.
Key points
- Criminals distributed tampered copies of ConnectWise ScreenConnect, a tool businesses use to let IT staff control computers remotely, beginning around 20 August 2026.
- The attack starts with social engineering: someone calls pretending to be tech support, then tricks the victim into handing over access.
- Once inside one machine, the malware spreads itself automatically to every other device connected through ScreenConnect on the same network.
- ConnectWise has confirmed a flaw in ScreenConnect's file-transfer feature and advises administrators to disable it immediately while a formal fix is prepared.
- Huntress spotted the same attack pattern across multiple separate organisations within days.
Security researchers at Huntress have uncovered a campaign that turns a widely trusted remote-support tool against the businesses that rely on it. ScreenConnect, made by ConnectWise, lets IT teams connect to employees' computers and fix problems remotely. Criminals have built modified, booby-trapped versions of it. As we reported on 7 September, the underlying file-transfer flaw was already drawing attention before this worm-like behaviour was fully understood.
How do the hackers get in?
Every incident Huntress documented began the same way: a phone call from someone pretending to be technical support. In the 20 August attack, the criminal told the victim to open Quick Assist, a remote-access program built into Windows, which handed the attacker direct control of the machine. The fake ScreenConnect client went in from there.
This is social engineering, meaning manipulation rather than technical trickery, and it's the front door for the entire campaign. The Spring Ring campaign we covered on 2 September used the same playbook through Microsoft Teams, tricking employees at ten-plus companies into handing over remote control.
What happens after the fake software lands?
Fast damage. The rogue ScreenConnect client immediately launches four VBScript files, small automated scripts, from a temporary folder on the victim's machine.
Those scripts work in sequence: they map out the infected machine, stage hidden payloads, erase setup traces, and attempt a UAC bypass, a technique that tricks Windows into granting full administrator rights without prompting the user. A second hidden ScreenConnect copy then installs itself, continuously checks for other connected devices, and pushes the same four-script chain to each one. That's why researchers call it worm-like.
The criminals also install UltraViewer, another legitimate remote-desktop tool, giving themselves a backup route even if the original infection is spotted.
| Event | Date | Detail |
|---|---|---|
| First confirmed attack | 20 August | Victim tricked via Quick Assist; five VBScript files executed |
| Second environment hit | 20 August | Same files, likely separate phishing attack |
| Third attack confirmed | 24 August | Same tools, same social-engineering starting point |
| ConnectWise advisory published | Late August | File-transfer flaw confirmed; fix pending |
Should ordinary employees and customers be worried?
Yes, if their employer uses ScreenConnect for IT support. Huntress observed the campaign spreading across multiple organisations, not just one. ConnectWise confirmed a real flaw in ScreenConnect's file-transfer feature, affecting cloud-hosted and on-premises deployments alike. A CVE identifier, the standard label assigned to a confirmed software vulnerability, hadn't been issued at time of publication, though ConnectWise said one would follow alongside an official patch.
Until that patch arrives, ConnectWise recommends that IT administrators disable file-transfer functionality inside ScreenConnect entirely. Huntress adds that any on-premises installation deserves extra scrutiny right now.
If someone calls claiming to be IT support and asks you to install anything or hand over remote access, verify their identity through a channel your company already uses before clicking anything.
