ScreenConnect Client Uses Repeated Custom c Parameters

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•3•1•10

Detects a ScreenConnect client launched with several repeated c= custom fields, which can carry attacker configuration and campaign metadata. This behavior has been observed in cryptojacking campaigns abusing ScreenConnect.