From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect

Reported 19 Mar 2026 by otx · Severity: medium

A newly discovered loader called SILENTCONNECT is being used in active campaigns to silently install ScreenConnect, a remote monitoring and management tool, on victim machines. The infection chain begins with users being redirected to a Cloudflare Turnstile CAPTCHA page disguised