Attackers Exploit Windows Screensavers to Drop Malware

Attackers Use Windows Screensavers to Drop Malware, RMM Tools

Threat actors are using Windows screensaver files (.scr) to get past defender lines and compromise organizations, with ReliaQuest Threat Research publishing a report detailing the novel approach to spear phishing. The attack involves luring users into running a Windows screensaver file, which installs a remote monitoring and management (RMM) tool, giving the attacker interactive remote control over the target’s operating system.

Why This Matters

The technical reality is that .scr files are portable executable (PE) programs that can run arbitrary code, but many users and organizations do not treat them as executables, creating a gap between perception and reality. This gap can lead to significant security risks, including unauthorized access, data breaches, and malware infections, with the average cost of a data breach exceeding $4 million.

Key Insights

• 75% of organizations have been targeted by spear phishing attacks, according to a report by Symantec (2022)
• Using legitimate RMM tools, such as JWrapper, can make it difficult for security tools to detect malicious activity, as seen in the GodRAT campaign (2025)
• Blocking non-business file-hosting services at the DNS or web proxy layer can reduce the risk of screensaver-based attacks, as recommended by ReliaQuest

Working Example

import os
import hashlib

def check_screensaver_file(file_path):
    # Calculate the hash of the file
    file_hash = hashlib.sha256(open(file_path, 'rb').read()).hexdigest()
    
    # Check if the file is a known malicious screensaver
    if file_hash in known_malicious_hashes:
        print("Malicious screensaver detected!")
        return False
    else:
        return True

# Example usage
file_path = "path/to/suspicious.scr"
if not check_screensaver_file(file_path):
    print("Do not execute the file!")

Practical Applications

• Use Case: Organizations can use application control solutions, such as Windows Defender, to enable execution from trusted, signed, and/or approved sources, reducing the risk of screensaver-based attacks.
• Pitfall: Failing to maintain an approved RMM allowlist and alert on unapproved RMM agent installations can lead to undetected malicious activity, as seen in the ReliaQuest report.

References:

• https://www.darkreading.com/application-security/attackers-use-screensavers-drop-malware-rmm-tools
• https://www.symantec.com/blogs/threat-intelligence/spear-phishing-attacks
• https://www.reliaquest.com/blog/attackers-use-windows-screensavers-to-drop-malware-rmm-tools