What is ScreenConnect?

ScreenConnect

criticalCyber Attacks

CISA Warns of Active Exploitation of Critical ConnectWise ScreenConnect Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-1709, a critical-severity vulnerability in ConnectWise ScreenConnect, to its Known Exploited Vulnerabilities (KEV) catalog following confirmed active exploitation. The flaw allows remote code execution, and CISA has issued a binding operational directive requiring federal civilian agencies to patch by September 30, 2026. Organizations using ScreenConnect are urged to apply the latest patches immediately.

BleepingComputer12 days ago1 min read

highPhishing

Attackers Use Multi-Hop Google Redirects for Phishing Campaign

Threat actors have been observed conducting a phishing campaign that leverages multi-hop redirects through Google services to bypass security filters. The attack chain ultimately harvests credentials or installs ScreenConnect remote access software on victim systems. The use of Google infrastructure as a redirect layer helps obfuscate the final malicious destination, making the campaign harder to detect with traditional email security tools.

Dark reading21 days ago1 min read

mediumvulnerability

ConnectWise Issues Temporary Mitigation for ScreenConnect Vulnerability Ahead of Patch

ConnectWise has disclosed a new vulnerability in its ScreenConnect remote access platform and shared temporary mitigation measures, stating a patch is planned for later this week. The flaw affects a widely deployed remote access tool, and until a patch is available, administrators are advised to apply temporary workarounds to reduce risk.

BleepingComputer23 days ago1 min read

highCyber Attacks

Hackers Abuse Faronics Deploy Admin Tool to Install ScreenConnect

Security researchers report that threat actors are abusing the Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install the ScreenConnect remote support software. The abuse was first highlighted by BleepingComputer on September 1, 2026. No specific vulnerability in Faronics Deploy itself has been identified; instead, attackers are using phishing to exploit the administrative capabilities of the tool.

BleepingComputer28 days ago1 min read

highCyber Attacks

Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook

Threat actors are conducting active RMM-fueled phishing campaigns as of August 2026, using diverse social engineering lures and rotating payloads to deliver ScreenConnect and establish persistent remote access to compromised networks. The campaign targets global victims via email and web lures, with reported potential for data exfiltration, lateral movement, and ransomware deployment. Specific threat actor attribution and victim counts remain unverified.

Dark readingabout 1 month ago1 min read