Skip to content
ScreenConnect Attacks Compromise 288 Endpoints in 48 Organizations

ScreenConnect Attacks Compromise 288 Endpoints in 48 Organizations

First seen 12 Nov 2026, 05:19 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 12, 2026 at 05:20 UTC
  • •288 endpoints across 48 organizations compromised due to ScreenConnect attacks.
  • •Attackers exploit compromised credentials or hijacked sessions to gain access.
  • •ConnectWise has disabled five third-party extensions as a precautionary measure.

A malware campaign targeting managed service providers (MSPs) has exploited compromised ScreenConnect environments to deploy rogue remote-access clients on customer devices. First detected on November 11, 2026, by Huntress, the campaign has affected at least 288 endpoints across 48 organizations. ConnectWise has disabled five third-party extensions in partner environments as a precaution, stating there is no evidence of a compromise in its infrastructure or ScreenConnect software. The attack method involves using ScreenConnect's Run Command functionality, potentially leveraging compromised credentials or hijacked operator sessions for initial access. Huntress has warned that attackers may also compromise MSP technician workstations during sessions with infected devices. ConnectWise is actively investigating the incidents and has advised partners to review account activity and enhance security measures.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2026-11-11
Malware campaign detected
Huntress identified an active campaign targeting MSPs using compromised ScreenConnect environments, affecting 286 endpoints.
BleepingComputer
2026-11-12
ConnectWise disables extensions
ConnectWise disabled five third-party extensions in partner environments following reports of unauthorized access.
Feeds.Feedburner

More articles in this cluster (4)

Following this threat?

Track SCKit in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (17)

1 / 3

Common questions

How many organizations are affected?
At least 48 organizations have been affected by the ScreenConnect attacks.
What should MSPs do to protect themselves?
MSPs should review account activity, disable potentially compromised extensions, and enhance security measures.
Is there evidence of a new vulnerability?
No evidence of a new vulnerability has been found; the attacks appear to exploit compromised credentials.