Phishing Lure Uses Signed ScreenConnect Installer to Enable Attacker Remote Access

A phishing campaign impersonated jewelry retailer Mejuri and used an invoice-payment notification to lure recipients into downloading a legitimate ScreenConnect remote-access installer presented as a PDF order document. SANS Internet Storm Center researcher Xavier Mertens found that the downloaded file, ScreenConnect.ClientSetup.exe, was preconfigured to connect over port 443 to an attacker-operated, ConnectWise-hosted ScreenConnect test account, potentially giving the attacker remote control if a recipient installed it.

The installer carried a valid ConnectWise digital signature, and its Authenticode digest matched the signed digest; analysis found no malicious overlay or certificate-table modification. The attempt illustrates abuse of legitimate remote monitoring and management software, rather than deployment of a modified binary or custom malware. Successful victim installation, data theft, victim numbers, and attribution to a named threat group were not established. Defenders should scrutinize unsolicited remote-access installers and restrict unauthorized RMM deployments rather than treating a valid signature as proof of safe use.