Recently, researchers discovered a campaign that uses backdoored versions of ScreenConnect, a remote access tool, to spread malware. Attackers modify these ScreenConnect clients to transfer and execute malicious payloads on newly connected devices, effectively creating a worm-like infection model. This means that as one system gets infected, it can then infect others, increasing the potential damage and spread. Companies using ScreenConnect should be aware of this threat, as it could compromise their systems and data integrity. Users are advised to check their ScreenConnect installations for any unauthorized modifications and to ensure they are using the latest, secure versions of the software.