NewsHive
CONTACT USANALYST PORTAL →
securityBACKGROUND

Hackers abuse Faronics Deploy admin tool to install ScreenConnect

BACKGROUND
1 SIGNALFIRST DETECTED 1 September 2026
Narrative synthesis pending — 1 signal collected.
How the story developed
Other feeds and industry voices
4 May
Phishing Campaign Hits 80+ Orgs Using SimpleHelp and ScreenConnect RMM Tools

An active phishing campaign has been observed targeting multiple vectors since at least April 2025, with legitimate Remote Monitoring and Management (RMM) software as a way to

REPORT · HOW · The Hacker NewsOPEN STORY
1 Jul
SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT

Unknown threat actors are leveraging the ScreenConnect remote access tool as a way to deploy and execute AsyncRAT. Kaspersky said the activity is part of a "massive, multi-domain,

REPORT · WHO · The Hacker NewsOPEN STORY
4 Aug
Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access

Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business

REPORT · WHAT · The Hacker NewsOPEN STORY
7 Sept
Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts

Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to

REPORT · WHAT · The Hacker NewsOPEN STORY
Sources
BleepingComputer

NewsHive monitors these sources continuously. All signal titles above link to the original reporting.

Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →