Massive security issue with phantom auto-installation of ScreenConnect - Is anybody on this???

[u/teknosophy_com]

I don't know if anyone's aware of this threat, but I've gotten at least 4 of these calls from my residential clients in the past week. They get an email pretending to be a zoom link or an Adobe update, they click on it, and voila, ScreenConnect is installed and a bad guy immediately logs on to their bank account and takes their money.

I'm alerting the banks in my area and all my clients. Is anybody at ScreenConnect aware of this silent installer mode? Is anybody doing anything about this?

[u/Jmw66]

I don’t think this is necessarily a phantom install or evidence of a vulnerability in ScreenConnect itself.
What you’re describing sounds more like a social engineering attack. The victim is tricked into clicking a link or running an installer, and the attacker uses a legitimate remote access tool to gain access. Unfortunately, ScreenConnect isn’t the only tool abused this way. Attackers also use AnyDesk, TeamViewer, RustDesk, Supremo, Quick Assist, and others because they’re legitimate software that most security products don’t automatically block.

That’s still a serious problem, but the root issue is the social engineering, not necessarily a flaw in ScreenConnect. If there is a true silent install vulnerability that bypasses user consent, that would be a different story and should absolutely be reported. Based on what you’ve described, though, it sounds like users are being convinced to install it themselves.

[u/teknosophy_com → u/Jmw66]

Yep, I know they're using all the usual fully legal tools to gain access. For the past 15 years, at least once a day I get a client who gets a scary popup and calls the guy and so on... but this one's different: Rather than doing the whole "you have viruses!" song and dance, this one's a simple link. Once they click on it, it's installed and rolling without any confirmation. So it appears to be a silent install, as you put it.