Rogue ScreenConnect Clients Deploy Four-Stage VBScript Chain to Newly Connected Hosts

ConnectWise ScreenConnect has been abused in three unrelated incidents to distribute a malicious four-stage VBScript chain to newly connected hosts, researchers from Huntress disclosed. The activity is described as worm-like in that the abuse of ScreenConnect access enables auto-execution of the VBScript payload on systems newly joining the environment.

The three observed initial-access vectors were:
- A Quick Assist tech-support scam
- A phishing-delivered MSI installer
- A fake update mechanism

In each case, once ScreenConnect access was established, the malicious VBScript chain was auto-executed on the newly connected host. The four-stage chain structure suggests a deliberate effort to evade detection and establish persistence or facilitate further malicious activity. Huntress noted that the incidents are unrelated but share the common abuse of ScreenConnect as the distribution vector. The exact victim count and full technical details of the VBScript stages remain under investigation.