# ScreenConnect Client Abused by Attackers via Mejuri-Themed Payment Receipt Phishing

> A phishing email impersonating jewelry brand Mejuri (fake $5,745.65 'EFT Wire Transfer' payment receipt) lures recipients to download ScreenConnect.ClientSetup.exe from a compromised Australian domain. The file is a genuine, validly ConnectWise-signed ScreenConnect client preconfigured to call back to an attacker-operated ConnectWise-hosted instance via a relay on port 443.

- **Published:** 2026-10-01T00:00:00Z
- **Last reviewed:** 2026-10-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2826
- **ID:** TL-2026-2826
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-01 SANS ISC handler Xavier Mertens documented a phishing email spoofing the sender contact@mejuri.com with the subject 'EFT Wire Transfer'. The body claims a payment of $5745.65 was received and urges the recipient to view order information; it also lists a phone number (+1(332)638474823), a typical callback-phishing/refund-scam element. The call-to-action points to hxxps://thelittlecupandsaucer.com.au/ScreenConnect.ClientSetup.exe, a download hosted on a .com.au domain that appears to be a compromised, unrelated website.

The downloaded executable is not tampered malware. It is a legitimate ScreenConnect client installer signed by 'ConnectWise, LLC' (DigiCert G4 Code Signing CA1) whose Authenticode digest matches and which has no overlay. The attacker-specific part is the embedded client configuration, extracted from the PE: relay instance-v2e3e2-relay.screenconnect.com, port 443, instance ID v2e3e2 (ConnectWise-hosted cloud instance), and an RSA-2048 instance key (SHA256 beginning 16b1cec1, ending 9b00ead7; the diary shows a truncated value). Per the analyst, this is a client preconfigured to call back to a (trial/test) account operated by the attacker. At the time of analysis the sample was unknown on VirusTotal.

Abusing a signed, commercially available RMM tool lets the actor skip custom malware: the valid signature and the trusted screenconnect.com relay domain blend into normal enterprise traffic, and once installed the actor has interactive remote control of the endpoint. The source gives no attribution, malware family, CVE, or follow-on activity. The pattern matches earlier RMM-abuse campaigns described by CISA/NSA/MS-ISAC in advisory AA23-025A (ScreenConnect and AnyDesk delivered via phishing for refund scams) and by Abnormal Security in 2025 (ScreenConnect delivered as fake Zoom/Teams installers). Defenders should treat any unsanctioned ScreenConnect client, especially one calling an instance not owned by the organization, as a potential intrusion.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1584.001 Domains
- T1684.001 Impersonation
- T1036 Masquerading
- T1219.002 Remote Desktop Software
- T1090 Proxy
- T1071.001 Web Protocols

## Sources

- [ScreenConnect Client (Ab)used by Attackers - SANS ISC Diary (Xavier Mertens)](https://isc.sans.edu/diary/rss/33388)
- [SANS ISC Diary 33388 (canonical page)](https://isc.sans.edu/diary/33388)
- [CISA/NSA/MS-ISAC AA23-025A: Protecting Against Malicious Use of Remote Monitoring and Management Software](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a)
- [Abnormal Security: ScreenConnect Abuse Phishing Campaign](https://abnormal.ai/blog/screenconnect-abuse-phishing-campaign)
- [UCSF IT: ScreenConnect-themed credential phishing (March 2024)](https://it.ucsf.edu/mar-2024-screenconnect-themed-credential-phishing)
- [SOC Prime: Phishing emails disguised as transaction receipts delivering ScreenConnect](https://socprime.com/active-threats/malware-phishing-scam-phishing-emails-disguised-as-transaction-receipts/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2826