Attackers Use Windows Screensavers to Drop Malware, RMM Tools

Executive summary: ReliaQuest observed a campaign where attackers use Windows screensaver (.scr) files delivered via business-themed phishing lures and cloud-hosted links to install a legitimate RMM (JWrapper), giving attackers persistent interactive access to victims' systems; the technique leverages the fact that .scr files are PE executables and can bypass controls if not explicitly restricted. Observed impacts include potential data theft, lateral movement, and ransomware; recommended mitigations are treating .scr files as executables in application control, maintaining an approved RMM allowlist and alerting on unapproved RMM installations, and blocking non-business file-hosting services at the DNS or proxy layer.