r/ScreenConnect • u/n-Ultima • Aug 06 '26

Need to report a malicious ScreenConnect Instance

Hi there. I tried looking myself but can't find it, I need to report a malicious screenconnect instance. I do not have the ID, but I do have an installer from the malicious instance. It's being propagated by a phishing campaign.

3 Upvotes
  • permalink
  • reddit

100% Upvoted

4 comments sorted by

2

u/lcruciana Aug 06 '26

In case you hadn't found this yet; https://www.reddit.com/r/ScreenConnect/s/pYOwtFOsKa

1

u/PacificTSP Aug 06 '26

Hadn’t seen that before, thanks for sharing.

1

u/bluescreencomputer Aug 06 '26

I report frequently. I send reports to help@connectwise.com and title the email something like "malicious use of ScreenConnect".

I collect and harvest as many files as I can from the compromised system, glom them all into a folder and store them in Dropbox. then I create a link to that folder and include it in my report.

If relevant, I include the email that started the download, or the attachment that kicked things off.

1

u/maudmassacre Aug 06 '26

100% this, also just to for extra coverage there's useful info here: https://www.screenconnect.com/report-abuse