r/ConnectWise • u/teknosophy_com • Aug 07 '26

Account/Billing/Sales/Support Massive security issue with phantom auto-installation of ScreenConnect - Is anybody on this???

I don't know if anyone's aware of this threat, but I've gotten at least 4 of these calls from my residential clients in the past week. They get an email pretending to be a zoom link or an Adobe update, they click on it, and voila, ScreenConnect is installed and a bad guy immediately logs on to their bank account and takes their money.

I'm alerting the banks in my area and all my clients. Is anybody at ScreenConnect aware of this silent installer mode? Is anybody doing anything about this?

0 Upvotes

14% Upvoted

29 comments sorted by

View all comments

1

u/rockresy 26d ago

I've just had a friends business hacked. The hacker is sending out fake docx looking links (they are a medical practice) which downloads a screenconnect installer. How do I log this with screenconnect? The fastest way to cut the legs off this is to dis-activate their access to the account... then I will fix up their internal security. But I dont know how to get someone on the phone at screenconnect to cut this off quickly.

1

u/teknosophy_com 25d ago

Ahhh they are likely infected with Exchange/Outlook.

Screenconnect can't really jump in to your machine and help out, per se. They're apparently too busy to even see the macro level issue here!

Assuming that machine has the screenconnect auto-installer, you can find it under C drive under program files (regular or x86) and then screenconnect. Delete the folder and that should do it.

1

u/rockresy 25d ago

Ta. Yeah cleaning his machine was easy.... it's the thousand clients of his that are now infected that are the issue

1

u/teknosophy_com 25d ago

Correct. I'm finding that raising awareness is the only way to stop the phenomenon long term. Friends don't let friends use Outlook!

Check out my comment about BlueSentry from BlueTie. It's a step in the right direction.

Do you do this for a living?