ScreenConnect Worm Spreads VBScript Chain to New Hosts

Introduction

Remote administration tools are supposed to make life easier for IT teams, but cybercriminals keep finding ways to turn them into weapons. A fresh investigation from Huntress has now pulled back the curtain on a worm-style operation that exploits ConnectWise ScreenConnect, a remote support platform trusted by managed service providers around the world. Rather than relying on a single infection route, the attackers are chaining together multiple delivery methods, all of which converge on the same goal: dropping a multi-layered VBScript payload onto machines that have just connected to an attacker-controlled ScreenConnect instance.

What makes this discovery particularly concerning is the worm-like behavior. Once a ScreenConnect client session is established with a victim machine, the attacker does not stop at one host. The malicious payload is designed to spread to other newly connected systems, turning routine remote support sessions into a self-propagating infection pipeline. Three separate incidents, each starting from a different initial access method, have already been linked to the same chain, suggesting either a shared toolkit, an active campaign operator, or both.

The Four-Stage VBScript Chain Explained

At the heart of the attack is a carefully sequenced VBScript chain that unfolds across four distinct stages. Each stage builds on the previous one, gradually expanding the attacker's foothold while making the malicious activity harder to spot during routine monitoring.

• Stage 1 – Initial Dropper: The chain begins the moment a victim connects to a rogue ScreenConnect session. A small, obfuscated script is silently written to disk and triggered. Its sole purpose is to validate that the environment is suitable for further exploitation and to fetch the next stage from a remote location.
• Stage 2 – Persistence and Evasion: Once execution is confirmed, the second script establishes persistence through registry modifications, scheduled tasks, or hidden startup locations. It also incorporates basic evasion routines, including checks for sandbox environments and security tools.
• Stage 3 – Payload Deployment: With persistence secured, the third stage delivers the main payload. Researchers observed this stage performing system enumeration, credential harvesting, and the staging of additional modules.
• Stage 4 – Lateral Propagation: The final stage is what gives the campaign its worm-like character. It monitors for new ScreenConnect client connections and attempts to push the entire chain onto those freshly connected endpoints, effectively turning every new remote session into another infection opportunity.

Three Different Doors, One Shared Destination

One of the most striking aspects of Huntress's findings is the diversity of initial access vectors used across the three incidents. There was no single phishing template, no shared exploit kit, and no consistent lure. Instead, attackers seem to be testing multiple approaches to see which delivers the best results.

The first incident began with a classic Quick Assist tech-support scam. Victims were socially engineered into launching Microsoft's built-in remote assistance tool and handing control over to a fake technician. From there, the attacker pivoted to installing a ScreenConnect client, which then triggered the VBScript chain.

The second case involved a phishing email carrying an MSI installer. The attachment masqueraded as a legitimate software update or installer, and once executed, it dropped both the ScreenConnect client and the first stage of the malicious script.

The third incident leaned on fake software downloads, where victims searching for popular utilities were redirected to look-alike sites that bundled ScreenConnect alongside the malicious VBScript loader.

Why ScreenConnect Is an Attractive Target

ScreenConnect is widely deployed across managed service providers, IT departments, and support organizations. Its core function, allowing a remote technician to connect to and control a customer machine, makes it inherently powerful. For an attacker, that same capability is invaluable.

By using a legitimate, signed remote access tool, attackers can blend their malicious activity with normal IT operations. Firewalls and endpoint protection products are often configured to trust ScreenConnect traffic, which means the VBScript payloads are executing inside a session that security tools have already been told to allow. This abuse of trust is a growing trend across the remote administration software space.

The Worm Behavior Raises the Stakes

Single-victim infections are bad enough, but the worm-like behavior observed in this campaign takes the risk to a new level. Because the fourth stage of the chain actively watches for new ScreenConnect connections, any technician or admin who connects to an already compromised machine risks extending the infection to their own endpoints or to the networks of other clients.

For managed service providers, this is the nightmare scenario. A single compromised technician session can cascade into dozens of customer environments, each carrying its own copy of the malicious script and ready to spread further the next time a remote session is opened.

Conclusion

The abuse of ConnectWise ScreenConnect to spread a four-stage VBScript chain is a reminder that legitimate tools remain one of the most reliable assets in a cybercriminal's toolkit. By chaining together social engineering, phishing, and fake software lures, attackers are finding multiple ways to slip past perimeter defenses and land inside trusted remote sessions. Once there, the worm-like design of the payload ensures that the damage extends well beyond the initial victim. Organizations should review their use of remote administration software, enforce strict session monitoring, and train support staff to recognize the warning signs of social engineering attempts. At Grivyonx Cloud, our work in AI-driven threat detection and cybersecurity automation is focused on exactly these kinds of stealthy, multi-stage attacks, helping security teams spot malicious behavior inside trusted tools before it has a chance to spread.