Attackers hijacked ScreenConnect remote access panels to push malware across at least 288 endpoints in 48 organizations. Cybersecurity firm Huntress detected the campaign on November 11 and described it as worm-like in behavior.
ConnectWise responded by disabling five third-party extensions across partner environments as a precaution.
The attack exploits legitimate remote support infrastructure against its own users. Attackers gained access to cloud-hosted ScreenConnect panels and used the built-in Run Command feature to install rogue ScreenConnect clients on managed endpoints. Those rogue clients then delivered SCKit, a custom malware toolkit that establishes persistent backdoor access and steals browser session cookies.
ConnectWise identified roughly 400 partner environments with at least one of the affected extensions installed, although it emphasized that the presence of extensions alone does not confirm compromise.
What makes this attack particularly dangerous is its lateral movement design. When a technician connects to an infected endpoint through ScreenConnect, the malware spreads back to their workstation. It then steals saved browser sessions and authentication tokens from that machine.
Because technicians typically manage multiple client environments, a single infected workstation enables attackers to pivot into every ScreenConnect panel that technician accesses. Huntress described this as a two-stage infection path: from endpoint to technician, and from technician to every reachable endpoint.
SCKit arrives as an encrypted payload through a Base64-encoded dropper. It then contacts an external server to fetch PowerShell scripts that add Microsoft Defender exclusions, install attacker-controlled ScreenConnect clients, and create a scheduled task called “TrapWatch.” Additionally, the toolkit replaces the legitimate ScreenConnect installation with an attacker-controlled copy. Huntress noted that at least one of the scripts contains detailed code comments characteristic of large language model-generated output.
ConnectWise stated it found no evidence of a vulnerability in ScreenConnect itself or a compromise of its own infrastructure. Instead, the company suspects attackers abused independent third-party extensions installed in partner environments. The compromised extensions include Labtech Plus, RMM Plus, RMM+, and their associated password link variants. Furthermore, the attacker tagged each compromised managed service provider with a sequential number. Because Huntress observed tags that start partway through the sequence, earlier victims likely exist.
Sophos independently confirmed the same attack pattern in a separate alert published the same day.
