● Covered by 1 source · 1 reportMedium impact1 negative
Rogue ScreenConnect Clients Distribute Four-Stage VBScript Chain to New Hosts
Key points
- Worm-like activity uses ScreenConnect to spread VBScript payloads.
- Three incidents observed in August 2026 with diverse initial access.
- Rogue ScreenConnect clients execute a four-stage VBScript chain.
- VBScripts profile hosts and enumerate security products.
Worm-like Activity Identified
Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect. This activity distributes a malicious Visual Basic Script (VBScript) payload to newly connected systems, indicating a method for spreading malware within networks.
Diverse Initial Access Methods
Huntress identified three unrelated incidents in August 2026 that used different initial access methods. These included a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake Geek Squad refund form lure. Each method ultimately led to the activation of a four-stage VBScript chain via rogue ScreenConnect installations.
VBScript Execution Chain
Once the rogue ScreenConnect instances were installed, they repeatedly spawned "wscript.exe" to execute a series of VBScripts named 1.vbs, 2.vbs, 3.vbs, and 4.vbs. The first script, 1.vbs, profiles the host by checking system resources, verifying existing ScreenConnect installations, and enumerating security products such as Cisco AMP, CrowdStrike, Huntress, Malwarebytes, SentinelOne, Sophos, and Symantec Endpoint Protection. The results of these checks are written to "%TEMP%\value.txt" as a three-bit state variable.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Cybersecurity researchers have identified worm-like activity using ConnectWise ScreenConnect to deploy a malicious four-stage VBScript payload on newly connected systems. This activity was observed in three separate incidents, each using different initial access methods to install rogue ScreenConnect instances that then execute the VBScripts.