A modified ScreenConnect client can transfer and run malware when a new support session connects. The first infection still needs social engineering, but one trusted remote session can become the bridge to the next PC.