ScreenConnect: attackers push rogue clients and SCKit malware to 288 managed endpoints

What happened

On 12 November 2026, ConnectWise disabled five third-party ScreenConnect extensions in partner environments. It did this as a precaution after reports of unauthorized access. ConnectWise says it has found no vulnerability in the ScreenConnect software and no compromise of its own infrastructure. Its first assessment is that a threat actor may be abusing independent third-party extensions installed in partner environments. How the attackers got in and the full scope are still being investigated.

Huntress is also tracking the activity, which it first detected on 11 November 2026 at around 17:47 UTC. According to Huntress, the attackers used access to cloud-hosted ScreenConnect panels to send Run commands. These commands installed rogue ScreenConnect clients on at least 288 managed endpoints in 48 organizations. Huntress has not seen evidence of a new vulnerability. Its current data points to stolen credentials or hijacked operator sessions as the way in.

The rogue clients deliver SCKit, a custom malicious toolkit. It keeps remote access open even without the original panel. It also adds Microsoft Defender exclusions, installs a second attacker-controlled ScreenConnect client, creates a scheduled task named "TrapWatch" and can replace the legitimate ScreenConnect installation with an attacker-controlled copy.

Huntress analysed the payloads and found code meant to spread further. When a technician connects to an infected endpoint, the code would steal the .aspxauth session cookie from the technician's workstation. It would then use that cookie on other panels and push a payload to every reachable session through the Shared Toolbox. Huntress says it has not yet seen this spread succeed. Sophos has separately reported unauthorized ScreenConnect client deployments that follow the same pattern.

Who is affected

This affects organizations that use ConnectWise ScreenConnect to manage endpoints and servers, mainly MSPs and IT service providers. The attacks seen so far used cloud-hosted ScreenConnect panels. ConnectWise has found about 400 partner environments with at least one of these extensions installed:

• Labtech Plus
• RMM Plus
• RMM+
• RMM Plus Password Link
• RMM+ Password Link

These extensions provide an API that can run remote commands. Access to it is protected by a passphrase that the partner sets during setup. ConnectWise stresses that having one of these extensions installed does not mean you are compromised. No ScreenConnect vulnerability has been identified, so there is no patch to install. Huntress noted that the attackers number each compromised MSP in sequence, and the numbers it has seen start partway through. Other MSPs may therefore have been hit earlier. That is why Huntress advises all ScreenConnect users to check their Run Command history, even if they have had no alerts.

What to do now

1. If you run ScreenConnect on-premises, disable the five extensions listed above, as ConnectWise asks. Do not turn them back on until ConnectWise says it is safe.
2. Check that your security controls (EDR, antivirus) are running on technician workstations and managed endpoints. Check for Microsoft Defender exclusions that nobody on your team added.
3. Preserve the ScreenConnect audit and session logs and any other logs that show suspicious activity before you change anything.
4. Reset the passwords of all ScreenConnect operators, end active operator sessions and make sure multi-factor authentication is on for every account. Change the passphrases of any extension APIs.
5. Review administrator accounts and permissions in every panel. Remove accounts and rights you cannot explain.
6. Treat any endpoint with a rogue ScreenConnect client or SCKit artifacts as compromised. Isolate it and investigate it. Clean it up or rebuild it before you trust it again. Also check the workstations of technicians who connected to it.

How to check whether you were hit

• Review the Run Command history in your ScreenConnect panels for commands nobody on your team ran, especially since 11 November 2026. Also look for unexpected extension installations, Toolbox activity and Shared Toolbox items.
• Look for sign-ins from unusual locations, repeated failed logins, unexpected MFA prompts, new administrator accounts and permission changes.
• On endpoints, look for ScreenConnect clients that do not belong to your own instance and for other remote access software you did not approve. Sophos linked the activity to the ScreenConnect instance IDs d905b2b1b165d0a9, 4b8f4089ddaac6a9 and df1f7ef0cfacd0d8, and to the additional instance IDs 2588ef5c15954b10 and ed630cc2c873b091.
• Search endpoints for a scheduled task named "TrapWatch" and for these files: sckit-run.bat, sckit-decoder.ps1, TrapWatch.ps1, Panel-Lateral.ps1, Run-Lateral-Full.bat, runnew.cmd, ToolboxRelayUploader.exe and Sqlite3.exe. Sophos also saw curl.exe download ScreenConnect.ClientSetup.msi to C:\Windows\TEMP\sc.msi, which msiexec.exe then installed silently.
• Search firewall, proxy and DNS logs for the IP addresses 185.99.255[.]28 and 155.94.150[.]39. Also search for these domains: ns[.]mo7sen[.]dev (including the path /EadF.php?p=4), sc[.]payproofkit[.]com, cdn007-digitaldownloads[.]com, newnewnew[.]gotdns[.]org and Soxnewwork[.]homedns[.]org.
• Watch for unexpected support requests, password reset messages and software downloads that arrive through a channel you normally trust.

If you find any of these indicators, report them to ConnectWise and treat the affected panels, technician workstations and endpoints as compromised.

Update November 14, 2026

Researchers now have a likely explanation for how the attackers got in. According to Huntress, the RMM+ extension skips ScreenConnect's user accounts, roles and MFA. Instead, it checks requests against one shared access key stored in the extension's settings. BleepingComputer and The Register report that RMM+ versions 1.0.31 and 1.0.32 have a flaw: if no access key has been configured, they accept a blank one. This let attackers run commands without signing in to ScreenConnect and without passing MFA. Resetting operator passwords and turning on MFA therefore does not protect an instance where RMM+ is still enabled. No fixed version of the extension has been announced yet.

• Make sure RMM+ and the related extensions are disabled on every instance, on-premises servers included. ConnectWise cannot disable them there for you.

• Review your Run Command history for commands that came through RMM+, even if your sign-in logs show no suspicious logins.

• https://www.huntress.com/blog/sckit-worm-rogue-screenconnect

• https://www.bleepingcomputer.com/news/security/new-worm-like-sckit-malware-targets-msps-in-screenconnect-attacks/

• https://www.theregister.com/security/2026/11/12/hackers-exploiting-screenconnect-plugin-flaw-to-spread-malware-across-hundreds-of-pcs/5309361

• https://www.cybersecuritydive.com/news/connectwise-disables-third-party-extensions-cyberattack-ScreenConnect/874490/

Sources

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://thehackernews.com/2026/11/screenconnect-attacks-target-at-least.html