Rogue ScreenConnect clients breach at least 48 organizations through cloud-hosted panels
The attacks used stolen operator sessions and a flawed third-party extension, so patched clients and tighter session control are the main defences.
A campaign that abused cloud-hosted ScreenConnect panels to push rogue remote-access clients to managed endpoints was first detected on November 11, 2026, and by Huntress's count has reached at least 288 endpoints across 48 organizations, with six MSPs compromised. Attackers ran commands through the platform's Run Command feature and reached every affected host within 90 minutes, roughly a third of them within the first ten minutes. The payload is SCKit, a toolkit that installs persistent backdoors, intercepts support sessions and can spread from a compromised endpoint to a technician's workstation. Huntress and ConnectWise point to the third-party RMM+ extension, whose versions 1.0.31 and 1.0.32 accepted a blank access key, and ConnectWise has disabled five RMM+ family extensions across about 400 partner environments. Blackpoint Cyber found that a previously patched ScreenConnect flaw, CVE-2026-84869, is blocked by the fix in version 26.6.5 even though the toolkit tries to use it, so the spread path relies on stolen operator sessions rather than an unpatched bug. Partners are being told to avoid interactive sessions with suspected devices, revoke active sessions and reset credentials from a trusted machine.
Why it matters
For managed service providers and their clients, remote-access tools are now a route into many networks at once. The campaign reached affected hosts within 90 minutes and can move from a compromised endpoint to a technician's workstation, so one breach can spread across a provider's customer base. The affected extension has been disabled, and the spread depends on stolen sessions rather than an unpatched bug, which points to session revocation and credential resets as the immediate priority for anyone who relies on these tools.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.