The malware toolkit uses a worm-like technique that exploits a previously patched ScreenConnect vulnerability, CVE-2026-84869, to execute malicious code on a technician's workstation when they connect to an infected device. Still, researchers at Huntress and Blackpoint Cyber say they have not observed successful exploitation of this flaw during the attacks, with Blackpoint confirming that the exploit failed in testing against a patched ScreenConnect client. The findings follow yesterday's widespread ScreenConnect attacks, in which attackers gained unauthorized access to cloud-hosted ScreenConnect environments and used the platform's Run Command feature to install rogue ScreenConnect remote-access clients on customer endpoints.
ScreenConnect is a remote access and support platform used by MSPs and IT teams to remotely manage and troubleshoot customer devices. According to an updated Huntress report, the attacks compromised at least 288 endpoints across 48 organizations, with all of the affected devices targeted within 90 minutes. Approximately one-third of those systems were affected within the first 10 minutes.
