> TritonInfoSec News
Home / Sep 08, 2026 / Story
0
#9 The Hacker News general September 07, 2026 at 11:36 UTC

Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts

By [email protected] (The Hacker News)

AI Summary

Huntress documented three unrelated incidents where backdoored ConnectWise ScreenConnect clients are spreading a four-stage VBScript malware chain to every newly connected host in a worm-like propagation pattern. Initial access vectors included Quick Assist tech-support scams, phishing-delivered MSI installers, and a fake software package, indicating multiple threat actors are abusing legitimate RMM tooling for lateral movement.

Read full article → https://thehackernews.com/2026/09/rogue-screenconn…

Relevance score: 80.0/100

# More from September 08

  1. 1
    Magento StyleSmuggler zero-day exploited to deploy Linux backdoor BleepingComputer
  2. 2
    Adobe Commerce Zero-Day Exploited to Backdoor Online Stores SecurityWeek
  3. 3
    Hackers exploit new MikroTik RouterOS flaws to hijack routers BleepingComputer
  4. 4
    Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication The Hacker News
  5. 5
    N-able patches max severity N-central flaw amid ongoing attacks BleepingComputer
  6. 6
    N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw The Hacker News
  7. 7
    BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations BleepingComputer
  8. 8
    Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits SecurityWeek
  9. 10
    Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released The Hacker News