Hackers Weaponize ScreenConnect to Spread Worm-Like Malware Across Windows Systems

Huntress reports a coordinated campaign where attackers use compromised or modified ScreenConnect remote-support clients to transfer and execute a four-stage VBScript loader across Windows hosts, enabling lateral propagation, persistence, privilege escalation, tunneling and cryptocurrency mining; the report details infection vectors (tech support scams, phishing), mitigation advice (reimage, audit ScreenConnect, monitor script/PowerShell activity) and provides extensive IoCs (filenames, SHA256s, IPs, domains, registry keys).