Malicious ScreenConnect instances are used in worm-like attacks to deliver and execute payloads to newly connected clients.