A highly coordinated remote-access campaign has compromised at least 288 computers across 48 organizations, with security researchers pinpointing a third-party extension as the entry point. The attackers exploited a vulnerability in the way this extension handled user authentication to gain access to multiple cloud-hosted ScreenConnect panels, allowing them to push malicious commands and install rogue versions of the remote-management software on affected machines.
At the heart of the issue is RMM+, an independently developed extension for ScreenConnect that allows other tools to manage sessions without user intervention. According to Huntress, a security company that tracked the activity, this extension bypasses ScreenConnect’s built-in authentication measures in favor of a shared access key. This key, which defaulted to blank in versions 1.0.31 and 1.0.32 of RMM+, essentially disabled the platform’s multifactor authentication, making it easy for attackers to gain unauthorized access.
The malicious software, dubbed SCKit by Huntress, installed rogue ScreenConnect clients on affected machines, replacing legitimate ones and reusing their code libraries to maintain a veneer of normalcy. The kit also contained code designed to steal user session cookies and replay them against the panel, potentially allowing attackers to reach other customers’ systems. However, according to Huntress, attempts to exploit this feature have so far been unsuccessful in every recovered host log.
ConnectWise, the maker of ScreenConnect, has acknowledged the incident and taken steps to address it by disabling RMM+ across approximately 400 partner environments where possible. The company maintains that there is no evidence of a compromise of its infrastructure or a vulnerability in ScreenConnect itself. Instead, the activity appears to involve a threat actor’s abuse of independent third-party extensions installed in partner environments.
This episode follows closely on the heels of another high-profile security incident involving ConnectWise and ScreenConnect. In September, Huntress began tracking worm-like activity that exploited a previously patched file-transfer flaw in ScreenConnect (CVE-2026-84869). While neither company has attributed the current incident or disclosed its full scope, it is clear that third-party extensions are a significant risk factor for remote-access platforms like ScreenConnect.
As this incident demonstrates, even seemingly legitimate software and tools can harbor vulnerabilities when used in conjunction with unvetted add-ons. Organizations relying on remote-management solutions should be aware of these risks and take steps to mitigate them, such as carefully evaluating the security posture of third-party extensions before installation. This includes verifying that any extension has been properly vetted by its creator and is up-to-date with the latest security patches. By being more vigilant in this regard, organizations can help prevent similar incidents from occurring in the future.
Source: CyberScoop — 2026-11-12