Malware Propagation

An infected ScreenConnect guest pushes scripts up the support session to the operator's host

Huntress says the modified client waits for a new host connection, then uses ScreenConnect's own file transfer and Run functions to place scripts on the operator's machine, which is why the interim guidance is a config toggle.