Rogue ScreenConnect Clients Are Hijacking Business Networks: What You Need to Know

If your business uses remote desktop or IT support software, pay attention. Researchers reported this week that attackers are deploying rogue ScreenConnect clients to spread a sophisticated four-stage malware chain to newly connected hosts. The Hacker News published the details on September 7, 2026, and the attack is active right now.

What Is Actually Happening

ScreenConnect, made by ConnectWise, is one of the most widely used remote support tools in Canada. IT teams use it to connect to employee computers and fix problems without being in the same room. It is legitimate, trusted software.

What attackers have figured out is that if they can get a rogue, tampered version of the ScreenConnect client installed on a machine, that machine becomes a launchpad. The moment a new device connects through that compromised client, the malware chain triggers automatically. The infection uses VBScript in four separate stages, which means it is designed to be hard to detect and hard to stop mid-execution.

This is not a phishing email that an employee has to click by mistake. Once a rogue client is in place, the spread to new hosts happens on its own. That is what makes this particularly dangerous for a small or mid-sized business where a single IT person or an outside managed services provider is connecting to dozens of machines every week.

Why Canadian SMBs Are at Risk

Remote support tools are everywhere in the Canadian SMB market. You may be using ScreenConnect directly, or your IT provider may be using it to manage your systems. Either way, the trust relationship built into these tools is exactly what attackers are exploiting.

To make things worse, ConnectWise issued a separate warning the same day about a new unpatched flaw in ScreenConnect itself. That means the attack surface right now is unusually wide. There is an active exploitation method using rogue clients AND an unpatched vulnerability in the legitimate software. Both were reported by BleepingComputer and The Hacker News on September 7, 2026.

If you are a business owner who relies on an IT provider to manage your systems remotely, you have every right to ask that provider what version of ScreenConnect they are running and what steps they have taken this week.

What the Four-Stage VBScript Chain Means in Plain Language

VBScript is a scripting language built into Windows. It has been used in malware for years because it can run quietly in the background without triggering obvious alerts on older security tools. A four-stage chain means the malware breaks its work into four separate steps. Each step only loads the next one when it is ready, which makes it harder for antivirus software to catch the full picture at once.

By the time the fourth stage runs, attackers typically have the ability to move files, execute commands, steal credentials, or install ransomware. The goal of the chain is persistence. They want to stay in your network long after the initial connection.

What We Recommend

• Audit every remote access tool on your network. If you or your IT provider uses ScreenConnect, confirm you are running the latest official version directly from ConnectWise. Do not use any client installer that came from an email, a file share, or an unfamiliar download link.
• Ask your IT provider for confirmation. If a managed services provider manages your computers, ask them directly whether their ScreenConnect environment has been reviewed this week in light of the active exploit reports. A good provider will already have an answer ready.
• Check your endpoint protection. Windows Defender alone is not enough against a staged VBScript attack. Businesses running modern endpoint detection and response (EDR) tools like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint have a much better chance of catching this mid-chain.
• Restrict who can install remote access clients. On every Windows machine in your office, only an administrator account should be able to install software. If a regular employee account can install a ScreenConnect client without entering admin credentials, that needs to change today.
• Review your VBScript exposure. Microsoft has been moving to disable VBScript by default in Windows 11. If your machines are running Windows 11 24H2 or later, VBScript is disabled by default. If you are still running older Windows versions or Windows 10, this attack vector is wide open.

The Bigger Picture

This attack follows a pattern we have been tracking for the past two years. Attackers are no longer just targeting your employees with phishing emails. They are targeting the tools your IT team uses to protect you. Remote access software, backup agents, monitoring platforms, all of these tools have deep system access by design. That makes them high-value targets.

The same week this rogue ScreenConnect campaign was reported, N-able issued its fourth emergency hotfix in five weeks for a critical unauthenticated remote code execution flaw in N-central, another IT management platform used by managed service providers. The pattern is clear. The software sitting between your business and your IT provider is under heavy attack right now.

If you want us to review what remote access tools are running in your environment and verify they have not been tampered with, reach out to our team. This is exactly the kind of check that takes us an hour and can save you months of recovery work.