{"id":3957,"date":"2026-05-28T15:27:04","date_gmt":"2026-05-28T14:27:04","guid":{"rendered":"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/"},"modified":"2026-05-28T15:27:07","modified_gmt":"2026-05-28T14:27:07","slug":"hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs","status":"publish","type":"post","link":"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/","title":{"rendered":"Hackers abuse UltraVNC, Splashtop, and ScreenConnect to hijack business PCs"},"content":{"rendered":"
\n

Hackers abuse UltraVNC, Splashtop, and ScreenConnect to hijack business PCs is attracting attention across the tech world. Analysts, enthusiasts, and industry observers are watching closely to see how this story develops.<\/p>\n

This update adds another signal to a fast-moving sector where product decisions, platform changes, and competition can quickly shape the market.<\/p>\n

When you purchase through links on our site, we may earn an affiliate commission. Here\u2019s how it works.<\/p>\n

Cybercriminals are abusing a whole swathe of legitimate programs, including Tiflux, UltraVNC, Splashtop, and ScreenConnect to take control of business computers, establish persistence, and continuously exfiltrate sensitive data. This is as reported by security researchers Huntress, who detailed the new campaign in an in-depth research paper.<\/p>\n

The attack starts with a carefully crafted phishing email, usually themed around an \u201cupdated Service Agreement from Network Solutions\u201d. The email claims that Network Solutions has modified its pricing statements and services and instructs the target to visit a page where they can review and accept the new terms.<\/p>\n

Victims that click the provided link are first asked to complete a CAPTCHA, likely to filter out bots and automated analysis. After that, they are asked to download a \u201csecured document\u201d which is just an installer for TIflux, a legitimate commercial (albeit fringe) Remote Monitoring and Management (RMM) tool.<\/p>\n

\"\"<\/figure>\n

Together with Tiflux, victims are also served other tools, including 7zip, an outdated version of the UltraVNC remote access tool, and a vulnerable driver called HwRwDrv.x64. The latter seems to be the key here, since it allows for potential privilege escalation.<\/p>\n

The attackers then use Tiflux to install either Splashtop or ScreenConnect (or, in some cases, both), before proceeding with the main goal – transmitting live screenshots, running platform utilities, establishing persistence, and exfiltrating data.<\/p>\n

Huntress saw the attacks in the wild in late February this year. The report doesn\u2019t mention any specific threat actor groups or names, but it does state that TIflux is a Brazilian tool, and that the threat actor’s infrastructure leverages a server domain ending in a Brazilian country-code top-level domain.<\/p>\n

In other words, it all points to this being a Brazilian attacker, going after Brazilian targets.<\/p>\n

Businesses can defend against RMM abuse by establishing a comprehensive asset inventory of all installed applications, implementing strict application controls, regularly auditing authorized RMMs and cross-referencing them against databases like LOLRMM to find tools frequently abused by threat actors, and reviewing logs for RMM activity.<\/p>\n

\u27a1\ufe0f Read our full guide to the best antivirus1. Best overall:Bitdefender Total Security2. Best for families:Norton 360 with LifeLock3. Best for mobile:McAfee Mobile Security<\/p>\n

\"\"<\/figure>\n

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.<\/p>\n

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he\u2019s written for numerous media outlets, including Al Jazeera Balkans. He\u2019s also held several modules on content writing for Represent Communications.<\/p>\n

Please logout and then login again, you will then be prompted to enter your display name.<\/p>\n

Why This Matters<\/h2>\n

This development may influence user expectations, future product strategy, and the competitive balance inside the broader technology industry.<\/p>\n

Companies in adjacent segments often react quickly to similar moves, which is why stories like this tend to matter beyond a single announcement.<\/p>\n

Looking Ahead<\/h2>\n

The full impact will become clearer over time, but the story already highlights how quickly the modern tech landscape can evolve.<\/p>\n

Observers will continue tracking the next steps and how they affect products, users, and the wider market.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Hackers abuse UltraVNC, Splashtop, and ScreenConnect to hijack business PCs is attracting attention across the tech world. Analysts,<\/p>\n","protected":false},"author":0,"featured_media":3958,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1504,1503,1502,1500,1501],"class_list":["post-3957","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-games","tag-brazilian","tag-screenconnect","tag-splashtop","tag-tiflux","tag-ultravnc"],"yoast_head":"\nHackers abuse UltraVNC, Splashtop, and ScreenConnect to hijack business PCs - gamingtodaynews.site<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hackers abuse UltraVNC, Splashtop, and ScreenConnect to hijack business PCs - gamingtodaynews.site\" \/>\n<meta property=\"og:description\" content=\"Hackers abuse UltraVNC, Splashtop, and ScreenConnect to hijack business PCs is attracting attention across the tech world. Analysts,\" \/>\n<meta property=\"og:url\" content=\"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/\" \/>\n<meta property=\"og:site_name\" content=\"gamingtodaynews.site\" \/>\n<meta property=\"article:published_time\" content=\"2026-05-28T14:27:04+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-05-28T14:27:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/gamingtodaynews.site\/wp-content\/uploads\/2026\/05\/Fowg5CRho52HwmHzebUugV-1280-80.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/\"},\"author\":{\"name\":\"\",\"@id\":\"\"},\"headline\":\"Hackers abuse UltraVNC, Splashtop, and ScreenConnect to hijack business PCs\",\"datePublished\":\"2026-05-28T14:27:04+00:00\",\"dateModified\":\"2026-05-28T14:27:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/\"},\"wordCount\":621,\"image\":{\"@id\":\"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/gamingtodaynews.site\/wp-content\/uploads\/2026\/05\/Fowg5CRho52HwmHzebUugV-1280-80.png\",\"keywords\":[\"Brazilian\",\"Screenconnect\",\"Splashtop\",\"Tiflux\",\"Ultravnc\"],\"articleSection\":[\"Games\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/\",\"url\":\"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/\",\"name\":\"Hackers abuse UltraVNC, Splashtop, and ScreenConnect to hijack business PCs - gamingtodaynews.site\",\"isPartOf\":{\"@id\":\"https:\/\/gamingtodaynews.site\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/gamingtodaynews.site\/wp-content\/uploads\/2026\/05\/Fowg5CRho52HwmHzebUugV-1280-80.png\",\"datePublished\":\"2026-05-28T14:27:04+00:00\",\"dateModified\":\"2026-05-28T14:27:07+00:00\",\"author\":{\"@id\":\"\"},\"breadcrumb\":{\"@id\":\"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/#primaryimage\",\"url\":\"https:\/\/gamingtodaynews.site\/wp-content\/uploads\/2026\/05\/Fowg5CRho52HwmHzebUugV-1280-80.png\",\"contentUrl\":\"https:\/\/gamingtodaynews.site\/wp-content\/uploads\/2026\/05\/Fowg5CRho52HwmHzebUugV-1280-80.png\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/gamingtodaynews.site\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hackers abuse UltraVNC, Splashtop, and ScreenConnect to hijack business PCs\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/gamingtodaynews.site\/#website\",\"url\":\"https:\/\/gamingtodaynews.site\/\",\"name\":\"gamingtodaynews.site\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/gamingtodaynews.site\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hackers abuse UltraVNC, Splashtop, and ScreenConnect to hijack business PCs - gamingtodaynews.site","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/","og_locale":"en_US","og_type":"article","og_title":"Hackers abuse UltraVNC, Splashtop, and ScreenConnect to hijack business PCs - gamingtodaynews.site","og_description":"Hackers abuse UltraVNC, Splashtop, and ScreenConnect to hijack business PCs is attracting attention across the tech world. Analysts,","og_url":"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/","og_site_name":"gamingtodaynews.site","article_published_time":"2026-05-28T14:27:04+00:00","article_modified_time":"2026-05-28T14:27:07+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/gamingtodaynews.site\/wp-content\/uploads\/2026\/05\/Fowg5CRho52HwmHzebUugV-1280-80.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/#article","isPartOf":{"@id":"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/"},"author":{"name":"","@id":""},"headline":"Hackers abuse UltraVNC, Splashtop, and ScreenConnect to hijack business PCs","datePublished":"2026-05-28T14:27:04+00:00","dateModified":"2026-05-28T14:27:07+00:00","mainEntityOfPage":{"@id":"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/"},"wordCount":621,"image":{"@id":"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/#primaryimage"},"thumbnailUrl":"https:\/\/gamingtodaynews.site\/wp-content\/uploads\/2026\/05\/Fowg5CRho52HwmHzebUugV-1280-80.png","keywords":["Brazilian","Screenconnect","Splashtop","Tiflux","Ultravnc"],"articleSection":["Games"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/","url":"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/","name":"Hackers abuse UltraVNC, Splashtop, and ScreenConnect to hijack business PCs - gamingtodaynews.site","isPartOf":{"@id":"https:\/\/gamingtodaynews.site\/#website"},"primaryImageOfPage":{"@id":"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/#primaryimage"},"image":{"@id":"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/#primaryimage"},"thumbnailUrl":"https:\/\/gamingtodaynews.site\/wp-content\/uploads\/2026\/05\/Fowg5CRho52HwmHzebUugV-1280-80.png","datePublished":"2026-05-28T14:27:04+00:00","dateModified":"2026-05-28T14:27:07+00:00","author":{"@id":""},"breadcrumb":{"@id":"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/#primaryimage","url":"https:\/\/gamingtodaynews.site\/wp-content\/uploads\/2026\/05\/Fowg5CRho52HwmHzebUugV-1280-80.png","contentUrl":"https:\/\/gamingtodaynews.site\/wp-content\/uploads\/2026\/05\/Fowg5CRho52HwmHzebUugV-1280-80.png","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/gamingtodaynews.site\/index.php\/2026\/05\/28\/hackers-abuse-ultravnc-splashtop-and-screenconnect-to-hijack-business-pcs\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/gamingtodaynews.site\/"},{"@type":"ListItem","position":2,"name":"Hackers abuse UltraVNC, Splashtop, and ScreenConnect to hijack business PCs"}]},{"@type":"WebSite","@id":"https:\/\/gamingtodaynews.site\/#website","url":"https:\/\/gamingtodaynews.site\/","name":"gamingtodaynews.site","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/gamingtodaynews.site\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/gamingtodaynews.site\/index.php\/wp-json\/wp\/v2\/posts\/3957","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gamingtodaynews.site\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gamingtodaynews.site\/index.php\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/gamingtodaynews.site\/index.php\/wp-json\/wp\/v2\/comments?post=3957"}],"version-history":[{"count":1,"href":"https:\/\/gamingtodaynews.site\/index.php\/wp-json\/wp\/v2\/posts\/3957\/revisions"}],"predecessor-version":[{"id":3961,"href":"https:\/\/gamingtodaynews.site\/index.php\/wp-json\/wp\/v2\/posts\/3957\/revisions\/3961"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/gamingtodaynews.site\/index.php\/wp-json\/wp\/v2\/media\/3958"}],"wp:attachment":[{"href":"https:\/\/gamingtodaynews.site\/index.php\/wp-json\/wp\/v2\/media?parent=3957"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gamingtodaynews.site\/index.php\/wp-json\/wp\/v2\/categories?post=3957"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gamingtodaynews.site\/index.php\/wp-json\/wp\/v2\/tags?post=3957"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}