Rogue remote-access campaign spread through ScreenConnect add-on, researchers say

Security researchers at Huntress said an intruder used access to multiple cloud-hosted ScreenConnect panels Wednesday to push commands to groups of managed endpoints, installing attacker-controlled copies of the remote-management software on at least 288 computers across 48 organizations. Roughly a third of the machines were reached within the first 10 minutes, and all of them within about 90 minutes, according to the company.

ConnectWise, which makes ScreenConnect, said it was investigating reports of unauthorized access to certain partner ScreenConnect environments and disabled five independently developed extensions across approximately 400 partner environments wherever it could take action. The company said it had “found no evidence of a compromise of ConnectWise infrastructure or a vulnerability in ScreenConnect itself.” 

“Our initial assessment suggests the activity may involve a threat actor’s abuse of independent third-party extensions installed in partner environments,” the company’s advisory said.

Huntress traced the activity to RMM+, one of the disabled extensions, which lets other tools manage ScreenConnect sessions without a user working through the console. The extension “bypasses ScreenConnect’s user accounts, roles, and MFA,” authenticating instead with a shared access key rather than the platform’s multifactor authentication, according to Huntress. 

In versions 1.0.31 and 1.0.32, the company said, “that key defaulted to blank, meaning the authentication check didn’t reject an empty value and a caller could pass the check when no key had been configured.” Most installations it reviewed appeared legitimate, “usually added for a project and left in place.”

The malware, which Huntress calls SCKit, installed rogue ScreenConnect clients, stopped the legitimate client and positioned the attacker’s copy to take its place, reusing the real client’s own code libraries so the machine “still looks normal.” 

The kit also carried code designed to steal a user’s session cookie and replay it against the panel to reach other customers’ systems, though Huntress said attempts to do that have “failed in every recovered host log we have checked so far.” 

The episode followed similar worm-like activity that Huntress began tracking in September, when it said ConnectWise released a security update for a file-transfer flaw in ScreenConnect, CVE-2026-84869, rated 9.9 out of 10 on the CVSS scale. This time, both companies described the entry point as an abused third-party extension rather than the platform itself, though neither has attributed the activity, and ConnectWise said the initial access method and full scope remain under investigation.

The incident also comes nearly a month after ConnectWise dealt with a supply-chain attack that Microsoft later attributed it to Storm-0940, a China-state-aligned group that used the ARTEX AI framework to automate password spraying and exploit privileged access to customers’ Microsoft 365 environments.