Primary sources: Huntress November 2026 ScreenConnect advisory, ConnectWise Trust Center ScreenConnect advisory

ConnectWise is investigating unauthorized access to some ScreenConnect partner accounts after Huntress said attackers used compromised cloud-hosted instances to install rogue remote-access clients on managed customer devices Wednesday^1,3,4.

Huntress told BleepingComputer it identified six compromised MSPs and more than 286 endpoints across 47 organizations, with the counts still climbing¹. In a partner advisory updated Wednesday, Huntress said Run Command activity began about 17:48 UTC on Nov. 11 and that the same toolkit and infrastructure appeared across multiple partners at once³.

ScreenConnect is a remote access and support platform used by MSPs and IT teams to manage customer devices¹. Huntress said an unauthorized party used Run Command to download a ScreenConnect client installer from attacker-controlled servers and install it as a second client reporting to attacker infrastructure³.

The firm said the same command then retrieved a PowerShell toolkit, installed a scheduled task running as SYSTEM, and placed a modified ScreenConnect client that impersonates the legitimate client³. Huntress said that component waits for a technician to connect and, when one does, can deliver the toolkit to the connecting technician³. BleepingComputer said it remains unclear whether that reverse-pivot behavior exploits a software flaw or abuses legitimate features¹.

ConnectWise told BleepingComputer it is "aware of reports of malicious activity affecting a limited number of ScreenConnect partners and are actively investigating"¹. In a Trust Center advisory published at 22:45 UTC Wednesday, ConnectWise said it identified five independent third-party extensions that may be associated with the activity and disabled them as a precaution⁴.

The extensions named were Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link⁴. ConnectWise said it found about 400 partner environments with one or more of them, that presence alone does not establish impact, and that on-premise partners must disable the extensions themselves^2,4. QUE.com reported the same Trust Center steps and said disabling the add-ons does not remove software already planted on endpoints^2,4.

ConnectWise's initial assessment is that extra remote-access software may have been deployed through those partner-added extensions; it said that theory, and reports of technician-workstation compromise during interactive connections, still need validation⁴. Huntress has not determined how attackers first reached the instances and asked partners for ScreenConnect audit logs from Sept. 1³. Huntress told BleepingComputer current telemetry points to compromised credentials and hijacked support sessions¹.

ConnectWise advised partners to avoid interactive ScreenConnect sessions to suspected compromised devices, investigate with other tools, revoke sessions, reset credentials from a trusted device, and verify multifactor authentication^1,4. Huntress told impacted partners not to connect to affected hosts from any ScreenConnect instance, treat technician workstations that did connect as compromised until checked, rotate privileged credentials, and block listed infrastructure³.

Huntress published indicators including 185.99.255.28, 155.94.150.39, several command-and-control domains, rogue client IDs 2588ef5c15954b10 and ed630cc2c873b091, a TrapWatch scheduled task, and staging paths under ProgramData and Windows Temp³. Sequential attacker-assigned tags such as Exploited<N> suggest other MSPs may have been compromised earlier, Huntress told BleepingComputer¹.

BleepingComputer said it found a July 25, 2026, VirusTotal sample of a Social Security-themed batch script that referenced one of those rogue client IDs and overlapping infrastructure¹. Whether that activity is the same campaign as the current MSP attacks remains unclear¹. Nobody has publicly tied Wednesday's activity to CVE-2026-84869, a separate September ScreenConnect file-transfer issue^2,4.