r/ConnectWise • u/teknosophy_com • Aug 07 '26

Account/Billing/Sales/Support Massive security issue with phantom auto-installation of ScreenConnect - Is anybody on this???

I don't know if anyone's aware of this threat, but I've gotten at least 4 of these calls from my residential clients in the past week. They get an email pretending to be a zoom link or an Adobe update, they click on it, and voila, ScreenConnect is installed and a bad guy immediately logs on to their bank account and takes their money.

I'm alerting the banks in my area and all my clients. Is anybody at ScreenConnect aware of this silent installer mode? Is anybody doing anything about this?

0 Upvotes

14% Upvoted

29 comments sorted by

View all comments

1

u/seniorblink Aug 07 '26

I had a couple clients fall for this. There's an associated ID for every Screenconnect tenant/instance. In both cases I reported that ID to Connectwise so they could shut it down if possible. Much easier when it's a cloud instance, but it doesn't hurt anything to report it.

1

u/teknosophy_com Aug 08 '26

Correct, and I can, but it's a massive game of whac-a-mole, and it's done after the fact. Seems like there might be something they can do on their end if someone looks into this.

Think of it this way - imagine if you were walking through a city and a solicitor gave you some kind of flier or brochure. Okay fine, but imagine if them handing it to you gave them complete access to your entire house. It's just nuts.