Three August lures ended in rogue ScreenConnect clients that spread a four-stage VBScript chain to every new host.