Rogue ScreenConnect Clients Distribute Four-Stage VBScript Malware

In August 2026, researchers observed a worm-like campaign abusing ConnectWise ScreenConnect to deploy malicious VBScript chains. Attackers achieve initial access through various social engineering tactics, including tech-support scams using Quick Assist, phishing-delivered MSI installers, and fake refund forms. Once a rogue ScreenConnect client is installed, it repeatedly spawns 'wscript.exe' to execute a sequence of four VBScript files (1.vbs through 4.vbs). This chain profiles the host, enumerates security software (e.g., CrowdStrike, SentinelOne, Sophos), and downloads modular payloads based on system state variables. The malware exhibits worm-like propagation by infecting host machines that connect to an already compromised ScreenConnect client. Depending on the environment, the payload can result in user-level backdoors, UAC bypass for privilege escalation, or the deployment of XMRig cryptocurrency miners. ConnectWise has acknowledged an issue with file transfer behavior in ScreenConnect remote access sessions that facilitates this activity.

Attack Chain

1. Initial access is established via social engineering (Quick Assist scam, phishing MSI, or fake refund lures) to deploy a rogue ScreenConnect remote access client.
2. The rogue ScreenConnect client triggers the execution of '1.vbs' using 'wscript.exe', which profiles host resources, enumerates installed security products, and writes a state variable to '%TEMP%\value.txt'.
3. '2.vbs' is executed, which checks the state variable and downloads an initial configuration file ('map.txt') from a remote source.
4. '3.vbs' downloads a secondary payload ('out.enc') based on the state variable defined in the first stage.
5. '4.vbs' launches 'runner.ps1' to decrypt 'out.enc', writing the result to '%APPDATA%\Microsoft\Windows\Templates\Classic\sys_cache.zip'.
6. The chain executes a final PowerShell script, 'PyTorchFix.ps1', to finalize the installation of backdoors, privilege escalation tools, or cryptominers.
7. The malware achieves persistence by creating a 'WindowsServiceHost' User Run key pointing to 'WindowsServiceHost.vbs'.
8. The infection propagates as the compromised client records 'ConnectionID' identifiers, infecting subsequent hosts that initiate new ScreenConnect sessions.

Impact

Impacted organizations face the risk of persistent remote access backdoors, privilege escalation, and unauthorized cryptocurrency mining. Multiple incidents have been identified involving diverse social engineering lures. If successful, the attack results in total system compromise, potential data exfiltration, and lateral movement across remote support infrastructure.

Recommendation

1. Disable the 'TransferFiles' and 'TransferFilesInSession' permissions within all ConnectWise ScreenConnect role definitions to mitigate the file transfer vector.
2. Implement endpoint detection rules to monitor for 'wscript.exe' or 'cscript.exe' spawning from 'ScreenConnect.Client.exe' or related processes in the temporary directory.
3. Hunt for 'WindowsServiceHost' Run key modifications and associated 'WindowsServiceHost.vbs' files in user AppData directories.
4. Block communication to the identified C2 infrastructure (e.g., 45.13.237.190, 131.123.40.98, tele-sync.opik.net) at the network perimeter.
5. Given the worm-like persistence and potential for deep-system compromise, re-image infected hosts from known-good media.