Attackers Use ScreenConnect Panels to Install Rogue Clients on 288 Endpoints Across 48 Organizations

Attackers used cloud-hosted ScreenConnect remote-support panels to push Run commands, which let operators execute scripts remotely, and installed rogue ScreenConnect clients on at least 288 managed endpoints across 48 organizations, Huntress said. The activity was first detected on Nov. 11, 2026, at about 5:47 p.m. UTC. The rogue clients create persistent backdoors that do not depend on the original panel, allowing attackers to return later even if the first access is cut off.

The evidence trail is split. ConnectWise said it disabled five third-party extensions, including Labtech Plus and RMM Plus variants, after reports of unauthorized access, and said there is no evidence of a ScreenConnect vulnerability or infrastructure compromise. It said the extension API is secured by a partner-configured passphrase and identified about 400 partner environments with at least one affected extension. Huntress separately observed Run Command abuse and released indicators including two IP addresses, domains and files such as sckit-run.bat and ToolboxRelayUploader.exe.

The pattern matters because ScreenConnect is used by managed service providers and IT teams to administer many customer systems from one console. If an operator panel is compromised through stolen credentials or a hijacked session, one command can fan out across every endpoint the panel controls. Huntress said the malware can also spread from an infected endpoint back to a technician's workstation, stealing browser sessions and authentication tokens, then pivot to other panels. That turns support access into a chain reaction.

The real-world stake is scale: a trusted tool becomes the attack surface. Organizations using ScreenConnect through partners are exposed not because their own patching failed, but because a remote-support path was abused. ConnectWise urged partners to disable the named extensions, preserve logs and watch for unusual sign-ins, new administrator accounts, unexpected remote commands and unapproved remote-access software. The exact initial access method remains under investigation, and the source says some toolkit functions were identified through payload analysis.