ScreenConnect attacks hit MSPs: rogue clients on 286 endpoints

Someone is driving your IT provider's remote-access tool, and it isn't your IT provider. An active campaign is abusing compromised ScreenConnect environments at managed service providers to install rogue remote-access clients on their customers' computers, BleepingComputer reported on November 11. Huntress counts six breached MSPs, 286 affected endpoints and 47 organizations so far, and the numbers are still rising. If an MSP handles your laptops, this is your problem too.

What actually happened

From BleepingComputer's reporting and ConnectWise's security advisories page:

• The method. Attackers use ScreenConnect's own Run Command feature to deploy a second, rogue ScreenConnect client on managed machines. That gives them remote access that lives outside the MSP's legitimate instance. Huntress says the activity started around 17:47 UTC on November 11.
• No CVE. Huntress told BleepingComputer it looks like abuse of legitimate features, not a software flaw. How attackers got in is still unknown. Huntress telemetry points to stolen credentials or hijacked operator sessions.
• ConnectWise's response. It confirmed unauthorized access to ScreenConnect partner accounts and disabled five third-party extensions across about 400 partner environments as a precaution: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link. On-prem customers have to disable them by hand.
• The caveat. Having those extensions does not prove you were hit, and turning them off does not remove access an attacker already set up on endpoints.
• The technician risk. Huntress warns that opening an interactive ScreenConnect session to an infected machine may compromise the technician's own workstation. Investigate with separate tools.

Why it matters for your business

This is the second MSP remote-management platform in trouble this week, after N-able pulled N-central offline. It's also not ScreenConnect's first rodeo: we have already covered CVE-2026-84869. The pattern is the same every time. One login at your provider is a master key to every machine you own.

Send your MSP five questions today:

1. Do you run ScreenConnect, cloud or on-prem?
2. Were any of the five extensions installed? If on-prem, are they disabled now?
3. Have you reviewed Run Command and Toolbox history for our machines, even without an alert?
4. Is MFA enforced on every ScreenConnect and identity-provider account, and were sessions revoked from a clean device?
5. Can you check our endpoints for a second ScreenConnect client that isn't yours?

Sources: BleepingComputer, ConnectWise security advisories.