Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

Reported 03 Sep 2026 by otx · Severity: medium

Multiple organizations experienced attacks beginning with social engineering that led to rogue ScreenConnect installations executing suspicious VBScript files. The attack chain involved four sequential VBScript payloads (1.vbs through 4.vbs) used to profile systems, check for sec