MalwarePublished 23 Jun 2026

Observed phishing URLs delivering RMM payload

Source AlienVault OTX General

Description

ScreenConnect is used in phishing URLs to deliver RMM payload. DocuSign has been observed to be the common theme in these phishing emails.

Impact

Successful interaction with the phishing URLs may result in the delivery and execution of RMM malware on the victim's system, potentially allowing attackers to remotely monitor and manage compromised machines. This can lead to unauthorized access and control over affected systems. The impact is limited to victims who fall for the phishing attempt.

Defensive guidance

Defenders should focus on user awareness training to recognize phishing attempts, implement email filtering to block malicious URLs, and monitor for suspicious ScreenConnect-related activity. Since this is not a vulnerability in ScreenConnect software itself, no software patch is required.

Summary

This threat involves phishing URLs that leverage ScreenConnect infrastructure to deliver RMM payloads to victims. The phishing emails frequently use DocuSign-themed lures to increase credibility and entice users to click the malicious links. The campaign is categorized as malware delivery via phishing but does not specify exploitation of a vulnerability in ScreenConnect itself. There is no indication of active exploits in the wild beyond the phishing activity.

Indicators of compromise

URLs 2

https://vy.ijnggpi.com/ftx/
https://web-g63lkz.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi

Hashes 1

a30a9779079dc897a15fed27f27f614fab77a20e953368808ba99ac6c6a3375b

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 23 Jun 2026, 20:24 UTC

MITRE ATT&CK techniques3 from threat tags

Technical details

Indicators of compromise

URLs 2

Hashes 1

Community reviews

Related threats