Weaponized ScreenConnect RMM Tool Deceives Users into Installing Xworm RAT

The SpiderLabs Threat Hunt Team recently uncovered a cyber campaign in which threat actors weaponised the genuine ScreenConnect remote management tool to spread the Xworm Remote Access Trojan (RAT) via a multi-phase infection chain.

The assault begins with social engineering, including phishing, malvertising, and deceptive social media posts, drawing victims to fake AI-themed websites that redirect to suspicious domains, and culminating in a disguised installer masquerading as an MP4 file that is actually the ScreenConnect.ClientSetup.msi binary, according to The SpiderLabs Threat Hunt Team.

Analysis shows the attackers manipulated Authenticode signatures to embed malicious configurations, enabling the modified binary to drop and run in the Temp directory while bypassing endpoint detection and response alerts, with the pre-configured client then connecting to attacker-controlled servers such as instance-keoxeq-relay.screenconnect[.]com using query parameters to facilitate stealthy remote access.

The execution chain is fileless, employing a dropped batch file that invokes mshta.exe, downloads a ZIP from a suspect domain, and uses a renamed pythonw.exe to fetch Base64-encoded Python code from a GitHub repository, enabling persistence via Run registry keys and process injection into browsers like chrome.exe and msedge.exe.

Indicators of compromise include specific URLs and a C2 IP (5.181.165[.]102:7705), and the campaign highlights how AI branding was used to boost social engineering effectiveness while manual threat hunting remains essential to detect such evasive threats.