NewsHive
CONTACT USANALYST PORTAL →
securityBACKGROUND

SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT

BACKGROUND
1 SIGNALFIRST DETECTED 1 July 2026
Narrative synthesis pending — 1 signal collected.
How the story developed
Other feeds and industry voices
4 May
Phishing Campaign Hits 80+ Orgs Using SimpleHelp and ScreenConnect RMM Tools

An active phishing campaign has been observed targeting multiple vectors since at least April 2025, with legitimate Remote Monitoring and Management (RMM) software as a way to

REPORT · HOW · The Hacker NewsOPEN STORY
1 Sept
Hackers abuse Faronics Deploy admin tool to install ScreenConnect

Phishing actors are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install the ScreenConnect

REPORT · WHAT · BleepingComputerOPEN STORY
4 Aug
Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access

Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business

REPORT · WHAT · The Hacker NewsOPEN STORY
7 Sept
Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts

Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to

REPORT · WHAT · The Hacker NewsOPEN STORY
Sources
The Hacker News

NewsHive monitors these sources continuously. All signal titles above link to the original reporting.

Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →