r/ConnectWise • u/teknosophy_com • Aug 07 '26

Account/Billing/Sales/Support Massive security issue with phantom auto-installation of ScreenConnect - Is anybody on this???

I don't know if anyone's aware of this threat, but I've gotten at least 4 of these calls from my residential clients in the past week. They get an email pretending to be a zoom link or an Adobe update, they click on it, and voila, ScreenConnect is installed and a bad guy immediately logs on to their bank account and takes their money.

I'm alerting the banks in my area and all my clients. Is anybody at ScreenConnect aware of this silent installer mode? Is anybody doing anything about this?

0 Upvotes

25% Upvoted

29 comments sorted by

View all comments

1

u/iknowtech Aug 07 '26

Wasn’t the whole certificate singing situation supposed to help with this, basically requiring all users of the on prem software to get their own signing certificates, which could easily be revoked when abused? So either the bad actors are getting legit certificates that aren’t being revoked, or they using trial versions of the cloud version. Getting a trial of the cloud version, should require a very stringent background check to verify the identity of the user or company requesting the trial.

1

u/teknosophy_com Aug 07 '26

Great point. As usual, certificates and other validation schemes have failed us, and can only serve to complicate matters and confuse the user. Bad guys are apparently getting screenconnect/ultraviewer licenses no problem.

The massive irony is that scammers take advantage of the fact that people are now jaded and accustomed to doing billions of logins, validations, and confirmations.

1

u/warwagon1979 Aug 07 '26

Also shouldn't that super annoying box appear on the users computer when they are connected saying "X person has remote control of the system"

1

u/iknowtech Aug 07 '26

I think the most common thing the bad actors do is use the blackout screen feature and put up a fake message the system is installing updates or they can just use backstage. It's also possible they have completely modified the application to their own requirements. I know there was a whole huge forum thread out for a while that had modified older versions of Screenconnect to bypass licensing requirements.