ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access .

In an advisory posted on its site, the company said there is no evidence that the incident involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software.

"Our initial assessment suggests the activity may involve a threat actor's abuse of independent third-party extensions installed in partner environments," it said . "We are continuing to validate this assessment. The initial access method and full scope remain under investigation."

ConnectWise has identified 400 partner environments with at least one of the third-party extensions installed. It also emphasized that the presence of the extensions alone does not indicate or establish compromise.

While these extensions provide an API capable of executing remote commands, access to that API is secured by a passphrase configured by the partner during setup, it added. The list of extensions identified for precautionary disabling is below -

RMM Plus Password Link

ConnectWise also said it has urged on-premises partners to disable the extensions, and is recommending all partners to ensure security controls are running, preserve suspicious activity logs, and stay vigilant for -

Unusual sign-ins, unfamiliar locations, repeated login failures, and unexpected multi-factor authentication (MFA) prompts

New administrator accounts or changes to user permissions

Unexpected extension installations, remote commands, and Toolbox activity

Unapproved remote-access software on customer devices and technician workstations

Unexpected support requests, password-reset messages, and software downloads through a trusted channel

The company has shared the following indicators of compromise (IoCs) -

IP addresses: 185.99.255[.]28 155.94.150[.]39

Domains and URLs: ns[.]mo7sen[.]dev ns[.]mo7sen[.]dev/EadF.php?p=4 sc[.]payproofkit[.]com cdn007-digitaldownloads[.]com newnewnew[.]gotdns[.]org Soxnewwork[.]homedns[.]org

ns[.]mo7sen[.]dev/EadF.php?p=4

sc[.]payproofkit[.]com

cdn007-digitaldownloads[.]com

newnewnew[.]gotdns[.]org

Soxnewwork[.]homedns[.]org

Artifacts: sckit-run.bat sckit-decoder.ps1 TrapWatch.ps1 Panel-Lateral.ps1 Run-Lateral-Full.bat runnew.cmd ToolboxRelayUploader.exe Sqlite3.exe

ToolboxRelayUploader.exe

Cybersecurity company Huntress, which is also tracking the activity, said it has observed attackers using access to cloud-hosted ScreenConnect panels to push Run commands with an aim to install rogue ScreenConnect clients on at least 288 managed endpoints across 48 organizations. The activity was first detected on November 11, 2026, at around 5:47 p.m. UTC.

Huntress told The Hacker News that it has not seen evidence of a new vulnerability, but noted the exact method through which the attacker got panel access remains unclear. Current telemetry points to compromised credentials or hijacked operator sessions to gain initial access, it said.

The overall attack unfolds in a worm-like fashion using a two-step process -

Initial access: Attackers use a compromised ScreenConnect panel's Run Command feature to deploy a rogue ScreenClient client across endpoints, creating a persistent backdoor that no longer depends on the original panel.

Lateral movement: When a technician connects to an infected endpoint through ScreenConnect, the malware can spread back to their workstation, steal saved browser sessions and authentication tokens, and pivot to other ScreenConnect panels the technician has access to.

"The rogue clients deliver SCKit, a custom malicious toolkit that establishes persistent remote access and creates a relay trap for intercepting session cookies," Huntress researchers Ben Nahorney and Susannah Matt said.

"The infection path works in two stages: from an infected endpoint to a technician who connects to it, and from a technician's workstation to every endpoint their panel can connect to. However, not all functionality has been observed during observed incidents; some functionality has been discovered through analysing the payloads."

SCKit is delivered as an encrypted payload and via a Base64-encoded dropper ("sckit-run.bat"), which then contacts a remote server to fetch a PowerShell payload ("sckit-decoder.ps1") that's responsible for launching the toolkit.

Other components of the malware are designed to add Microsoft Defender exclusions, install a second attacker-controlled ScreenConnect client, create a scheduled task named "TrapWatch," and replace the legitimate ScreenConnect installation with an attacker-controlled copy.

There are signs that at least one of the scripts is generated by a large language model (LLM) based on the detailed source code references and that explain its functionality.

"Going beyond what we've observed, we've reconstructed an additional functionality intended to spread from a technician's workstation to the ScreenConnect panel," Huntress said. "This has been discovered from analysis of its scripts, configuration, and tools. To date we have not observed a successful jump from an infected endpoint to a technician workstation, or from that workstation to other endpoints."

This involves abusing the connection to fetch a dropper ("Run-Lateral-Full.bat"), which then connects to an external server ("ns.mo7sen[.]dev") to download a loader that gathers the workstation's unique ID, sends it back to the attacker, and returns a tailored encrypted kit for that specific workstation -

"Panel-Lateral.ps1," which in conjunction with "LabConfig.ps1," steals the .aspxauth session cookie from the workstation and attempts to replay the cookie against the panel and get the tokens necessary to enumerate any other sessions the technician can access.

"ToolboxRelayUploader.exe," which leverages access gained to any other sessions to upload a payload, "WithUninstall.ps1," to the panel's Shared Toolbox.

"A panel request tells every reachable session to run the toolbox item," Huntress said. "This payload is designed to run as SYSTEM on those endpoints, installing the trap and extending the cycle. Roughly 60 seconds after the broadcast, ToolboxRelayUploader.exe deletes the Shared Toolbox item."

To add to the concern, the threat actor has been observed tagging each compromised managed service provider (MSP) with a sequential number. Huntress said the tags it has observed start partway through the sequence, indicating other MSPs may have been compromised earlier. ScreenConnect users are advised to check their Run Command history even if they haven't received alerts.

In a separate alert, Sophos said it has also observed unauthorized ScreenConnect client deployments following the same modus operandi. The activity has originated from three ScreenConnect instance IDs -

It's suspected that these are compromised instances that are being used to execute commands and deploy additional malicious instances, whose IDs are below -

"Curl.exe downloaded ScreenConnect.ClientSetup.msi from 185.99.255[.]28 to C:\Windows\TEMP\sc.msi," Sophos explained . "A ScreenConnect-generated command file then launched msiexec.exe to install the client silently. The researchers also observed ScreenConnect scripts staging batch files and using PowerShell with execution-policy bypass to retrieve a second-stage script from ns[.]mo7sen[.]dev/EadF.php?p=4."

(This is a developing story. Please check back for more details.)