ScreenConnect remote-management platform abused to push rogue clients via MSPs, hitting 47 organisations and 286+ endpoints

1. Nov 12, 2026, 1:47 AM
   Huntress observes campaign against cloud-hosted ScreenConnect begin^[1]
2. Nov 12, 2026, 6:56 AM
   Media report ConnectWise investigating the attacks^[1]
3. Nov 12, 2026, 6:39 PM
   Intrusions traced to auth flaw in third-party RMM+ extension; ConnectWise disables related extensions^[2]

   SecurityWeek reports Huntress said the campaign compromised at least 6 MSPs and 288 hosts across 48 organizations, with all hosts hit within 90 minutes to deploy rogue ScreenConnect clients and a malware toolkit called SCKit (persistent backdoor, session-cookie interception, self-replication). Huntress says the attackers exploited a flaw in the third-party ScreenConnect extension RMM+: versions 1.0.31 and 1.0.32 accept a blank access key if none was configured. ConnectWise disabled five RMM+ family extensions (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, RMM+ Password Link) across about 400 ScreenConnect environments; Huntress and ConnectWise released IoCs and recommend disabling the extensions in on-premises deployments.

Vendor guidance

1. 1
   Stop interactive sessions to suspect devices mitigate^[1]

   Avoid interactive ScreenConnect sessions to suspected compromised devices and investigate with separate tooling.

2. 2
   Review Run Command history and IOCs detect^[1]

   Check Run Command history even without alerts and match against Huntress IOCs.