Cryptojacking via ScreenConnect - Spoofed App Dropping Autorun.dll

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•5

Detects MSI loading the malicious autorun.dll from temporary download paths, which is indicative of cryptojacking activity often associated with campaigns abusing ScreenConnect and .NET utilities.