Key Takeaways
- Huntress said attackers used cloud-hosted ConnectWise ScreenConnect panels on November 11, 2026, to install rogue ScreenConnect clients and a toolkit called SCKit on at least 288 computers at 48 organizations over about 90 minutes.
- Huntress linked the November 11, 2026, ScreenConnect attacks to RMM+, a third-party ScreenConnect extension whose versions 1.0.31 and 1.0.32 accepted a blank access key when an administrator had never set one.
- ConnectWise disabled five third-party ScreenConnect extensions, including RMM+, in about 400 partner environments as a precaution and told partners that run ScreenConnect on their own servers to disable the extensions themselves.
- ConnectWise said on November 12, 2026, that it had found no evidence of a compromise of its own infrastructure or of a vulnerability in ScreenConnect itself, and that the initial access method and full scope were still under investigation.
What happened
ConnectWise ScreenConnect is a remote access and support platform that managed service providers (MSPs), companies that run IT for other organizations, and internal IT teams use to manage and troubleshoot computers remotely, BleepingComputer reported.
At about 17:47 UTC on November 11, 2026, the security firm Huntress saw suspicious activity on computers connected to several ScreenConnect environments, it said in a report. An operator with access to several cloud-hosted ScreenConnect panels used the panels' Run command feature to send commands to many computers at once, according to Huntress.
The commands installed ScreenConnect clients controlled by the attackers and a toolkit Huntress calls SCKit. Huntress said SCKit sets up lasting remote access and a trap meant to capture session cookies, the small pieces of data that keep a user logged in to a website. The rogue clients give the attackers remote access outside the MSP's own ScreenConnect environment, BleepingComputer reported.
Huntress said the attackers reached all 288 computers within 90 minutes, about a third of them in the first 10 minutes. In a first count posted on Reddit, Huntress said it was tracking six compromised MSPs and more than 286 computers, and that "those numbers are climbing," according to BleepingComputer.
How the attackers got in
ConnectWise published a security advisory at 22:45 UTC on November 11. It said it was aware of reports of unauthorized access to ScreenConnect partner accounts and of unauthorized remote access software being installed in customer environments. It said it suspected the attackers had used independent third-party extensions that partners may have added to their environments.
ConnectWise named five such extensions: LabTech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. In an update at 02:45 UTC on November 12, it said these extensions provide a way to run remote commands that is protected by a passphrase the partner sets during setup.
In an update at 11:34 p.m. Eastern time on November 11, Huntress said the activity appeared to be linked to RMM+, a third-party extension that lets another tool manage ScreenConnect sessions without a technician using the console. Huntress said RMM+ checks requests against a shared access key instead of ScreenConnect's user accounts and multi-factor authentication (MFA). In RMM+ versions 1.0.31 and 1.0.32, the extension accepted a blank key when an administrator had never set one, Huntress said.
The commands reached computers across several ScreenConnect instances within minutes, with no matching login activity, and appeared in logs linked to RMM+, according to Huntress. Huntress said the affected ScreenConnect versions included the most current releases, 26.6.6.9747 and 26.7.6.9783.
ConnectWise said it had found no evidence of a compromise of its own infrastructure or of a vulnerability in ScreenConnect itself. It said the initial access method and full scope were still under investigation.
Who is affected
About 400 partner environments had at least one extension from the RMM+ family installed, ConnectWise said, and their presence alone does not establish a compromise. ConnectWise said it had no reason to believe partners who had not deployed the five extensions were affected.
Huntress said the attackers' numbered tags suggest that other MSPs may have been compromised earlier, according to BleepingComputer.
Huntress found code in SCKit designed to spread from an infected computer to a technician's workstation when the technician connects to it, and from there to other computers the technician can reach. Huntress said it had not seen that spread succeed. ConnectWise said it had received reports of technician workstations being compromised during such connections, which it was still validating.
BleepingComputer found that one of the rogue client IDs Huntress listed appeared in a malicious script first uploaded to the VirusTotal scanning service on July 25, 2026. How that earlier activity relates to the November attacks remains unclear, BleepingComputer reported.
What organizations should do
ConnectWise told partners to confirm the five extensions are disabled and not to re-enable or reinstall them until it gives further guidance. ConnectWise disabled them wherever it could; partners that run ScreenConnect on their own servers must disable them manually.
ConnectWise advised partners to investigate suspected compromises with separate security tools and to avoid interactive ScreenConnect connections to suspect devices. It also advised keeping authentication, extension installation, administrative, run command, and toolbox records, revoking active ScreenConnect and identity provider sessions, resetting credentials, and enforcing MFA. Disabling the extensions and resetting credentials alone may not remove software or access already placed on computers, ConnectWise said.
Huntress advised all ScreenConnect users to review their environments even without an alert, looking for unexpected mass activity in Run command and toolbox history and for an unauthorized second ScreenConnect client on managed computers. It said isolating an affected computer does not remove what the attackers installed, and that affected systems have reinfected shortly after isolation was lifted. ConnectWise and Huntress published indicators of compromise in their reports.
Background
In September 2026, Huntress responded to similar activity that spread rogue ScreenConnect clients across several customer environments, it said. ConnectWise later released a security update for CVE-2026-84869, a critical file transfer flaw rated 9.9 out of 10, according to Huntress.