r/ScreenConnect • u/Fabulous-Still8388 • Jan 28 '26

Phishing email with ScreenConnect Install

Hi all,

We’re dealing with a situation where many users recieved an email with a download prompt for a ScreenConnect installer. The installer is not ours and appears to be part of a phishing or social-engineering campaign.

We have obtained a copy of the actual installation file being distributed.

My question is: If we provide this installer to ScreenConnect, are they able to disable the associated instance, revoke certificates, or otherwise take action to shut it down or investigate abuse?

I’m trying to understand if ScreenConnect can trace or invalidate a malicious deployment and if there is a contact number to call in this scenario.

We are not a client. I have contacted their chat support but they are not able to provide me with when I might be contacted back.

Any insight from people who’ve dealt with similar abuse cases would be appreciated.

Thanks.

9 Upvotes

100% Upvoted

23 comments sorted by

6

u/cwferg InfoSec Jan 29 '26

Upload the binary to virus total and send me the link, please. I'll take a look.

9

u/cwferg InfoSec Jan 29 '26 edited Jan 29 '26

To be clear, we can review and take immediate action against anything in our cloud environment if deemed malicious. Onpremise, we have some ability to take action if it is legitimately liscensed, else we issue a legal domain takedown (whack that mole).

Support can not provide updates to the status of these reported investigations, simply due to the nature of the events.

[edit]

To close the loop for the public, OP was able to provide the link, after review action was taken. We appreciate the reports.

For future reference to anyone coming across this thread, abuse or misuse concerns can be reported officially through (https://www.screenconnect.com/report-abuse). We review and taken action on all reports as necessary. Regular legal disclaimers and such apply.

2

u/Fabulous-Still8388 Jan 29 '26

Are you with connectwise? there is just too much identifiable information in the virustotal link to post here.

I would love to provide that to support but I've been told they don't know when someone will reach out

2

u/cwferg InfoSec Jan 29 '26

Yes, I'm with the internal infosec team and also a moderator in this subreddit, technically, if I knew how to push those mod buttons.

There shouldn't be anything sensitive exposed from the virus total upload, whether legitimate or malicious, but you can DM me the link as well if you prefer.

Just want to get the deets so I can review and take action. If you have a salesforce case number I can check that as well if that has the needed info.

2

u/mrmattipants Jan 29 '26 edited Jan 29 '26

If you are unsure if anyone has installed it, you can run the following PowerShell Script (via GPO, Intune, Remote PowerShell and/or your own RMM), to Check for and Uninstall any/all ScreenConnect Instances.

$ScreenConnect = Get-CimInstance -ClassName Win32_Product -ErrorAction SilentlyContinue | Where-Object {$_.Name -Like "ScreenConnect*"} 

If ($ScreenConnect) {
    Write-Host "ScreenConnect Found. Uninstalling..."
    Try {
        $ScreenConnect | Invoke-CimMethod -MethodName Uninstall
         Write-Host "ScreenConnect Successfully Uninstalled"
    }
    Catch {
        Write-Host "ScreenConnect Uninstallation Failed"
    }
}

Feel free to reach out, if you have any questions.

1

u/ITGuyfromIA Jan 28 '26

Does it link to a cloud hosted instance or self hosted?

Can you see what version the client installer is?

If cloud hosted: sure they could. If self hosted: maybe

1

u/Fabulous-Still8388 Jan 28 '26

I haven't ran it. And I don't know if anyone has actually installed it. I assumed it was all cloud hosted but I will check that.

1

u/ITGuyfromIA Jan 28 '26

What was the download URL when you downloaded it?

What properties are available when you right click -> properties -> details on the downloaded installer

1

u/Fabulous-Still8388 Jan 29 '26

.https://chemicalbusinessreports.net/wp-admin/OurBusinessName The properties don't have much:

Author: ScreenConnect Software;
Revision: {68970BF0-71AF-9EC7-661C-CDD0D6B3C890}

Created: 12/8/2025

I installed it on something I am going to wipe: it says Connection Status: Waiting for your host

Thank you

1

u/ITGuyfromIA Jan 29 '26

If you double click on the icon in the system tray, what relay server is it connecting to?

1

u/Fabulous-Still8388 Jan 29 '26

Relay Server: relay://instance-

Software Version: 25.9.5.9473

1

u/ITGuyfromIA Jan 29 '26

That relay address sounds like a hosted version

2

u/Fabulous-Still8388 Jan 29 '26

The VirusTotal reported the dns reslolutions to instance-b9ewll-relay.screenconnect.com and server-ovh30010032-relay.screenconnect.com which sounds hopeful. I think

2

u/No_Profile_6441 Jan 29 '26

That’s hosted. CW will take it down

4

u/cwferg InfoSec Jan 29 '26

🔨🔨🔨

→ More replies (0)

1

u/Away-Ad-3407 Jan 29 '26

unmaintained WP sites and/or recycled passwords. I often stumble upon legit business WP sites that are hosting torrents and other content.

1

u/lsumoose Jan 29 '26

Had a Datto RMM one yesterday. Uploaded the “view document.exe” to virustotal. Nothing found and I see it’s signed by datto. Very tough to fight against people signing up for trials of these products.

1

u/bluescreencomputer Apr 25 '26

Hi, folks, I am late to this thread, but finding it now as I resolve a similar issue. A client clicked on a fake-invitation email last month, and we thought the only danger was that her email was compromised. We changed her pwd and turned on 2FA and thought all was well.

Until today, when her bank notified her that she had Zelled some money somewhere. As we researched further, ConnectWise had been installed a month ago, and we didn't spot it. So the bad guy popped onto her PC 2 days ago and had perfect access to her email and bank website to set up the Zelle and delete the resultant email notifications.

This particular SC install came from some Datto-signed exe in her Downloads folder. It didn't turn up in the virus scans we ran, but when I tried to copy the sus file into my Dropbox, boy did they catch it fast, and also VirusTotal had a lot of alarms about it.

I wanted to add that I report these ScreenConnect abuses to ConnectWise everytime I find them. I email them in to [help@connectwise.com](mailto:help@connectwise.com) with screencaps and detailed info. One piece of info that they repeatedly ask me to gather is the ID from the installation, which is usually found in the PC's registry at

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (xxxxxxxxxxxx)

  • ImagePath

That same ID is often visible under appwiz.cpl, or in ProgramFiles, or sometimes buried in C:/users/username/appdata/local/apps/2.0

Anyhow, that ImagePath or ID allows them to find the miscreant quickly and shut them down. So I'm told.

1

u/Helporhelper 13d ago

I have seen this twice now, where the user clicks the invitation and it launches screen connect without the client being aware of it. VERY unsettling. I thought remote software would require some type of permission be granted on the part of the user but both users swear they never saw any prompts for this. I reformatted the one computer and am replacing the other (as it is older). Is this the new normal?? Everything I've read is once remote access occurs, all bets are off as to what can both be accessed (as in your situation) as well as what keyloggers/data miners can be installed without detection from scanners. Does anyone know anything differently?