The fake refund form, the remote-control app, and the bit where it spreads

ScreenConnect is a real product. IT departments use it to take control of a computer from somewhere else, which is exactly why scammers love it, and why a copy of it landing on a home PC is such bad news. Huntress published its findings on 3 September after seeing the same infection at three unrelated victims in late August.

The three arrived by different routes, and all three are routes a normal person could take. One was talked through a fake Quick Assist support session. One opened a phishing email carrying a file called ScreenConnect.ClientSetup.msi. The third went looking for a Geek Squad refund form, which is the tail end of the oldest scam email in the book, and ran a malicious ScreenConnect.Client.exe instead. From there the doctored client fires off four small scripts, 1.vbs through 4.vbs: the first sizes up the machine and checks which security software is installed, the second pulls an encrypted list of payloads from Dropbox, and the last two decrypt and run whatever the list says you qualify for. That has included a hidden backdoor, tools to gain administrator rights, tunnelling software and a cryptocurrency miner, plus Defender exclusions so none of it gets looked at.

The nasty flourish is the spreading. The modified client abuses ScreenConnect's own file-transfer feature to push those four scripts onto machines that connect to it, so an infected computer can pass this to the technician's system rather than the other way round. ConnectWise now advises turning file transfer permissions off. For anyone at home the rule is simpler and older: nobody from Best Buy, Microsoft or your bank will ever ring you and ask you to install remote-control software. If you already did, Huntress is blunt about the fix, and it is not a virus scan. The machine gets rebuilt.

Tendvane checks whether remote-access software is installed on your PC as part of its Safety check, so a tool that arrived during a phone call you now regret does not simply sit there unnoticed.