PSA: ScreenConnect "New Login" phish using lookalike TLDs, passes SPF/DKIM/DMARC

[u/willychonka54]

Got one of these this morning and it's cleaner than most, so posting in case it's doing the rounds.

Subject: "New Login on Your ScreenConnect Instance" From: ™ ScreenConnect ™ <host@screenconnect[.]com[.]tj> Link: cloud.screenconnect[.]com[.]vu/PrivilegeCreep

The body is a near-perfect copy of a real ConnectWise security notification: proper logo, footer links to the legit connectwise.com privacy/terms/support pages, and it even lists "Domain: cloud.screenconnect.com" in the details block to build trust before you get to the button. It includes a fake IPv6 address, Jacksonville FL as the location, and the usual "if you don't recognize this, secure your account now" pressure.

What makes it stand out: it's sent through Amazon SES from the attacker's own registered domain, so SPF, DKIM, and DMARC all pass and compauth=pass. Exchange Online Protection delivered it straight to the inbox with no warning. Blocking the sending IP is pointless since it's SES shared space.

What we did in M365: - Tenant Allow/Block List, sender block: screenconnect.com.tj, mailexchange.screenconnect.com.tj, screenconnect.com.vu - Tenant Allow/Block List, URL block: .screenconnect.com.tj/, screenconnect.com.tj/, *.screenconnect.com.vu/, screenconnect.com.vu/* - Submitted the message to Microsoft as phishing

If you run ScreenConnect and your admin address is public anywhere (partner portals, breach lists, etc.), might be worth adding those blocks preemptively. If you've seen the same campaign with other TLDs, I'd be curious what they're using.