ScreenConnect
Coverage of ScreenConnect in the Nexus archive.
- COLDCARD security audit phishing attack installs remote access tool
A phishing campaign is exploiting concerns about a COLDCARD wallet vulnerability and a suspected $88.6 million Bitcoin theft to trick users into installing ScreenConnect remote access software. The attack leverages fears surrounding the security audit to deploy malicious tools.
- Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook
The attacks use diverse social engineering lures and rotating payloads to deliver ScreenConnect for persistent remote access to compromised networks. The threat actor's playbook involves exploiting RMM systems through these methods.
- SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT
Unknown threat actors are using the ScreenConnect remote access tool to deploy AsyncRAT via spoofed websites. Kaspersky reports a 'massive, multi-domain, multi-language' campaign distributing malicious installers disguised as popular software like OBS Studio and Bandicam.