Attackers use Crypto Exchange Names to Disguise Unauthorized Sessions on 100+ ScreenConnect Servers

Attackers exploited publicly accessible guest installer links on over 118 ScreenConnect servers to register more than 2,200 unauthorized remote sessions, disguising them with legitimate-sounding crypto exchange names to avoid suspicion. The core failure was that guest access was left open without adequate restrictions or vetting, allowing anyone to create sessions that blended in with normal activity. Because monitoring was insufficient, these sessions persisted for over 10 days before discovery, and in at least one case a technician unknowingly sent keystrokes to a fraudulent session, risking credential exposure. This incident illustrates how permissive remote access configurations combined with weak session visibility can create a stealthy foothold for attackers before any overtly malicious action is even taken.