Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts

Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to newly connected systems. According to Huntress, three unrelated incidents have been found to use diverse initial access methods, namely a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake

Report facts: Researchers observed worm-like activity abusing ConnectWise ScreenConnect clients to automatically push a multi-stage VBScript payload to newly connected hosts, across at least three unrelated incidents that used different initial access vectors (tech-support scam via Quick Assist, phishing MSI, and a fake installer). The malicious chain leverages remote access tooling as a propagation mechanism once ScreenConnect is present in the environment. RealGround analysis: For organizations embedding remote management tools or similar software into AI-enabled operations, this highlights AI supply chain risk from compromised or abused third-party remote access infrastructure, which can undermine monitoring and security controls that depend on those tools. Hardening remote tooling, validating provenance/configuration of such components, and maintaining an SBOM-style inventory for software that interfaces with AI systems reduces the chance that an attacker can pivot through these platforms into AI agents or adjacent data and control planes.