Attackers Use ScreenConnect to Plant Rogue Remote Access Through MSPs

Security firm Huntress said that on November 11, 2026, attackers began using hijacked ScreenConnect panels at managed service providers (MSPs) to install rogue remote-access clients on their customers’ computers. ConnectWise, which makes ScreenConnect, responded by disabling five third-party extensions across about 400 partner environments as a precaution, according to The Hacker News and BleepingComputer.

What’s new

Huntress said it first saw the activity at about 17:47 UTC and counted at least 288 affected computers across 48 organizations, all of them hit within 90 minutes. The attackers used the panel’s Run Command feature to push their own ScreenConnect client, which gives them a way back in even after the provider’s own access is cleaned up.

• ConnectWise said in an advisory, as reported by The Hacker News, that it found no sign of a ScreenConnect flaw or a breach of its own systems, and that the activity may involve abuse of independent third-party extensions.
• The disabled extensions are Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link, per The Hacker News.
• Huntress said the way in is still unknown, with stolen credentials or hijacked sessions as the current suspicion.

Who it affects

Any business whose computers are looked after by an outside IT provider that uses ScreenConnect. You won’t see a pop-up or an error. The risk sits with the tool your provider uses to reach your machines, which is why a phone call to them matters more than anything you can check alone. If you run your own computers and nobody uses ScreenConnect to reach them, this campaign doesn’t touch you.

Our take

We’d treat this as a short checklist for this week. Today, ask your IT provider three things: do they use ScreenConnect, were any of the disabled extensions installed, and have they checked your PCs for an extra remote-access client. If they say yes to the last part, expect password resets and sign-outs across Microsoft 365 or Google Workspace, and make sure two-factor sign-in is on for every admin account.

If you’d like a second set of eyes on how your systems are managed, our IT consulting and website maintenance teams can help, and our recent brief on the Barracuda email gateway flaws covers a similar supplier-side risk. Huntress published its full analysis on its blog.