Hackers Weaponize Trust with AI-Crafted Emails to Deploy ScreenConnect

Securityweek reports that hackers are weaponising trust with AI-crafted phishing emails to deploy ConnectWise ScreenConnect for remote access, with more than 900 targeted enterprises identified worldwide. The campaigns typically begin by compromising a legitimate email account and then expanding outward by abusing the victim’s address book and conversations, according to Piotr Wojtyla, head of threat intelligence at Abnormal AI.

Recipients are lured through AI-generated “professional” emails that disguise links or attachments, often framed as Zoom or Microsoft Teams meeting invites, and are designed to avoid triggering security controls. Observed techniques include wrapping malicious URLs in legitimate domains via SendGrid, using Open Redirects, Base64-encoded link segmentation, and leveraging Cloudflare Workers to host attack infrastructure.

The attackers also perform lateral phishing to spread ScreenConnect within organisations or partner networks, effectively turning it into a supply chain attack and enabling potential turnover of compromises to access brokers, according to the report.