Hackers Using Windows Screensavers to Bypass Security and Install Malware

Cybercriminals exploit .scr files as phishing bait, bypassing security to install remote tools and control infected systems.

By Content Team

Feb 5, 2026

ON THIS PAGE

Cybercriminals are exploiting a sneaky new trick: using Windows screensaver files (.scr) to slip past security defenses and compromise organizations. ReliaQuest researchers discovered attackers sending business-themed phishing emails with links to malicious screensaver files hosted on cloud storage platforms.

The clever part? Most people don't realize screensaver files are actually executable programs that can run any code. This makes them perfect for bypassing security tools that might catch traditional malware.

Once victims download and run these files, they install legitimate remote management tools like JWrapper, giving hackers full control over the infected computer. From there, attackers can steal data, spread through networks, or deploy ransomware.

Source: Dark Reading

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?