Attackers compromised 288 machines across 48 organizations in 90 minutes by abusing cloud-hosted ScreenConnect environments, according to Huntress findings reported by SecurityWeek and The Register. The November 11, 2026 attacks used the remote-support tool to deploy malware and involved at least six managed service providers (MSPs), companies that manage customers’ IT systems. That was Huntress’s observed tally in The Register’s November 12 report, not an established total for the campaign. SourceSource
ConnectWise responded by disabling five third-party extensions from the RMM+ family across approximately 400 ScreenConnect environments where it could act remotely. Those environments were identified because they contained the extensions, not because investigators had confirmed 400 compromises. ConnectWise said, as quoted by SecurityWeek: “Their presence alone does not establish compromise.” SourceSource
The suspected entry route: a blank access key
Huntress suspects the attackers exploited an authentication weakness in RMM+, an extension that lets other management tools issue commands through ScreenConnect. According to its analysis, quoted by SecurityWeek, versions 1.0.31 and 1.0.32 accepted a blank access key if an administrator had never configured one. That’s an alarming amount of power to hand to an empty field. SourceSource
RMM+ operates separately from ScreenConnect’s normal user authentication, so the weakness could potentially allow commands to run without an attacker having to defeat multifactor authentication. Huntress found commands reaching managed machines without corresponding login activity; the reviewed logs instead pointed to RMM+. SourceSource
ConnectWise has not confirmed how the attackers initially got in. In its advisory, quoted by The Register, the company said: “At this time, we have found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself.” Source
SCKit also tries to target the repair crew
According to Huntress’s findings reported by The Register, the attackers deployed a malware toolkit called SCKit that installs a separate ScreenConnect client. That gives them a way to retain remote access even if the legitimate connection is shut down. Source
The toolkit also contains code intended to target a technician who connects to an infected machine: it attempts to transfer malware to the technician’s workstation, steal authentication cookies and use that access to reach other machines, potentially including other customers. Source
Huntress said, as quoted by The Register: “We have not observed that method to spread work successfully. The console-takeover attempt failed in every recovered host log we have checked so far.” Source
Even so, Huntress and ConnectWise warn administrators not to investigate suspected infections by connecting through ScreenConnect. The reported guidance is to use other security tools, inspect remote-command history, look for unauthorized ScreenConnect clients and remove malware before bringing affected machines back online. A failed spreading attempt in the logs is not an invitation to volunteer the technician’s workstation for another try. Source
Customers running their own ScreenConnect servers are being urged to disable the relevant extensions themselves: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link. ConnectWise’s remote disabling action should not be mistaken for remediation of every self-hosted deployment. SourceSource
ConnectWise also warned, as quoted by The Register: “Disabling extensions and resetting credentials alone may not remove unauthorized software, persistence mechanisms, or access already established on endpoints.” An extension’s off switch is not a malware uninstaller. Source
Comments