SCREENCONNECT SUPER ADMIN CREDENTIAL HARVESTING

Summary from the TLDR InfoSec newsletter

Mimecast is reporting on a low-volume spear-phishing campaign that has been active since 2022, targeting super admins of ScreenConnect instances. The attackers send an email warning admins of a new login attempt and prompting them to review it, and if they click through, it directs the admins to an EvilGnix phishing page that harvests their credentials. The attackers use the access to deploy compromised clients and ransomware.