Threat Actors Exploit ScreenConnect Installers for Initial Access

Threat Actors Exploit ScreenConnect Installers for Initial Access

A marked escalation in the abuse of ConnectWise ScreenConnect installers since March 2025, with U.S.-based businesses bearing the brunt of these incursions. Adversaries are now deploying lightweight ClickOnce runner installers—devoid of embedded configurations—to evade static detection, fetching malicious components at runtime.

Source: GBHackers

Date:

5 September 2025

Categorie(s):

Tag(s):

Cyber Security News, Initial Access, Installers, Security Pro, Vulnerability

Implement custom authentication for tools integration using request Lambda interceptor in AgentCore Gateway18 August 2026
New TWINLOOT Malware Steals Windows Passwords Via Fake Lock Screen18 August 2026
Expired credit cards revived by researchers to make unauthorized payments18 August 2026
Eight years later, federal authorities re-up charges against alleged Iranian hackers at Mabna Institute18 August 2026
Your 404 Pages Are a Goldmine for Hackers18 August 2026