ScreenConnect Exploitation and Worm-Like VBScript Campaign

In late August and early September 2026, a significant cyber campaign was identified targeting Managed Service Provider (MSP) environments through ScreenConnect instances. The campaign exploits CVE-2026-84869 (CVSS 9.9), a critical flaw in file-transfer handling that allows unauthenticated file execution on host systems. Attackers use initial access gained via hijacked operator sessions or social engineering to deploy rogue ScreenConnect clients and a multi-stage VBScript loader chain.

The attack is notable for its 'worm-like' propagation mechanism: modified ScreenConnect clients automatically push the malicious VBScript stagers to any newly connected host sessions. Once established, the malware profiles the system for security software (including Huntress, CrowdStrike, and SentinelOne) and deploys payloads based on the system's defensive posture. These payloads include credential scrapers (sqlite3.exe), tunneling tools (wstunnel), and XMRig miners.

This activity presents a high risk to the MSP supply chain, as the malware can pivot from an infected endpoint back to a technician's workstation and subsequently infect all other managed panels. Affected organizations should immediately update ScreenConnect to version 26.6.5 or higher and audit logs for unauthorized 'RunFiles' or 'RanFiles' events involving .vbs scripts.