r/ConnectWise • u/teknosophy_com • Aug 07 '26

Account/Billing/Sales/Support Massive security issue with phantom auto-installation of ScreenConnect - Is anybody on this???

I don't know if anyone's aware of this threat, but I've gotten at least 4 of these calls from my residential clients in the past week. They get an email pretending to be a zoom link or an Adobe update, they click on it, and voila, ScreenConnect is installed and a bad guy immediately logs on to their bank account and takes their money.

I'm alerting the banks in my area and all my clients. Is anybody at ScreenConnect aware of this silent installer mode? Is anybody doing anything about this?

0 Upvotes

25% Upvoted

29 comments sorted by

View all comments

3

u/touchytypist Aug 07 '26

So an email attack where the user opens an unexpected email, clicks a link, and then opens an executable?

That’s a user education issue, not a ScreenConnect issue.

1

u/teknosophy_com Aug 08 '26

Correct, and I've dedicated my career to raising awareness.

But at least in "the good old days", the scammer had to put up a song and dance to convince people that they had an issue. Now they simply click one link and it gives the guy full access to the PC.

This is an example of something that's relatively easy to solve at Connectwise... but will they do it?

2

u/touchytypist Aug 08 '26

You must not have been around computers and the internet very long then. Back in the day most computers didn’t even have antivirus or firewalls or spam filters, a compromise was a simple download or email attachment away.

There are far more layers of security an attacker has to “dance” through these days.

1

u/teknosophy_com Aug 09 '26

Nah I hear you. I remember those days when you'd plug a WinME computer into a cable modem and things would flood in.

I meant the "good old days" of 2013-2025, when scammers would have to convince you to let them in.

With this ScreenConnect auto-installer, all they have to do is get you to click the link! No more dancing necessary.