ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients Ravie LakshmananNov 12, 2026Malware / Endpoint Security ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access. In an advisory posted on its site, the company said there is no evidence that the incident involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software. "Our initial assessment suggests the activity may involve a threat actor's abuse of independent third-party extensions installed in partner environments," it said. "We are continuing to validate this assessment. The initial access method and full scope remain under investigation." ConnectWise has identified about 400 partner environments with at least one of the third-party extensions installed. It also emphasized that the presence of the extensions alone does not indicate or establish compromise. While these extensions provide an API capable of executing remote commands, access to that API is secured by a passphrase configured by the partner during setup, it added. The list of extensions identified for precautionary disabling is below - ConnectWise also said it has urged on-premises partners to disable the extensions, and is recommending all partners to ensure security controls are running, preserve suspicious activity logs, and stay vigilant for - Unusual sign-ins, unfamiliar locations, repeated login failures, and unexpected multi-factor authentication (MFA) prompts New administrator accounts or changes to user permissions Unexpected extension installations, remote commands, and Toolbox activity Unapproved remote-access software on customer devices and technician workstations Unexpected support requests, password-reset messages, and software downloads through a trusted channel The company has shared the following indicators of compromise (IoCs) - Cybersecurity company Huntress, which is also tracking the activity, said it has observed attackers using access to cloud-hosted ScreenConnect panels to push Run commands with an aim to install rogue ScreenConnect clients on at least 288 managed endpoints across 48 organizations. The activity was first detected on November 11, 2026, at around 5:47 p.m. UTC. Huntress told The Hacker News that it has not seen evidence of a new vulnerability, but noted the exact method through which the attacker got panel access remains unclear. Current telemetry points to compromised credentials or hijacked operator sessions to gain initial access, it said. The overall attack unfolds in a worm-like fashion using a two-step process - Initial access: Attackers use a compromised ScreenConnect panel's Run Command feature to deploy a rogue ScreenClient client across endpoints, creating a persistent backdoor that no longer depends on the original panel. Lateral movement: When a technician connects to an infected endpoint through ScreenConnect, the malware can spread back to their workstation, steal saved browser sessions and authentication tokens, and pivot to other ScreenConnect panels the technician has access to. "The rogue clients deliver SCKit, a custom malicious toolkit that establishes persistent remote access and creates a relay trap for intercepting session cookies," Huntress researchers Ben Nahorney and Susannah Matt said. "The infection path works in two stages: from an infected endpoint to a technician who connects to it, and from a technician's workstation to every endpoint their panel can connect to. However, not all functionality has been observed during observed incidents; some functionality has been discovered through analysing the payloads." SCKit is delivered as an encrypted payload and via a Base64-encoded dropper ("sckit-run.bat"), which then contacts a remote server to fetch a PowerShell payload ("sckit-decoder.ps1") that's responsible for launching the toolkit. Other components of the malware are designed to add Microsoft Defender exclusions, install a second attacker-controlled ScreenConnect client, create a scheduled task named "TrapWatch," and replace the legitimate ScreenConnect installation with an attacker-controlled copy. There are signs that at least one of the scripts is generated by a large language model (LLM) based on the detailed source code references and comments that explain its functionality. "Going beyond what we've observed, we've reconstructed an additional functionality intended to spread from a technician's workstation to the ScreenConnect panel," Huntress said. "This has been discovered from analysis of its scripts, configuration, and tools. To date we have not observed a successful jump from an infected endpoint to a technician workstation, or from that workstation to other endpoints." This involves abusing the connection to fetch a dropper ("Run-Lateral-Full.bat"), which then connects to an external server ("ns.mo7sen[.]dev") to download a loader that gathers the workstation's unique ID, sends it back to the attacker, and returns a tailored encrypted kit for that specific workstation - "Panel-Lateral.ps1," which in conjunction with "LabConfig.ps1," steals the .aspxauth session cookie from the workstation and attempts to replay the cookie against the panel and get the tokens necessary to enumerate any other sessions the technician can access. "ToolboxRelayUploader.exe," which leverages access gained to any other sessions to upload a payload, "WithUninstall.ps1," to the panel's Shared Toolbox. "A panel request tells every reachable session to run the toolbox item," Huntress said. "This payload is designed to run as SYSTEM on those endpoints, installing the trap and extending the cycle. Roughly 60 seconds after the broadcast, ToolboxRelayUploader.exe deletes the Shared Toolbox item." To add to the concern, the threat actor has been observed tagging each compromised managed service provider (MSP) with a sequential number. Huntress said the tags it has observed start partway through the sequence, indicating other MSPs may have been compromised earlier. ScreenConnect users are advised to check their Run Command history even if they haven't received alerts. In a separate alert, Sophos said it has also observed unauthorized ScreenConnect client deployments following the same modus operandi. The activity has originated from three ScreenConnect instance IDs - It's suspected that these are compromised instances that are being used to execute commands and deploy additional malicious instances, whose IDs are below - "Curl.exe downloaded ScreenConnect.ClientSetup.msi from 185.99.255[.]28 to C:\Windows\TEMP\sc.msi," Sophos explained. "A ScreenConnect-generated command file then launched msiexec.exe to install the client silently. The researchers also observed ScreenConnect scripts staging batch files and using PowerShell with execution-policy bypass to retrieve a second-stage script from ns[.]mo7sen[.]dev/EadF.php?p=4." (This is a developing story. Please check back for more details.) Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cyber Attack, endpoint security, Malware, Remote Access Security Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out The Flood is Coming And The Pipes Were Already Full Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Experts Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Accelerate Incident Response: 95% Faster Containment Cut containment time from 48 hours to 3. Read the Orchid IR case study. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk