Hackers Exploit Authentication Flaw in ScreenConnect Plugin to Deploy Malware on Hundreds of PCs
An active hacking campaign exploited an authentication vulnerability in the RMM+ third-party extension for ScreenConnect, allowing attackers to bypass multifactor authentication and deploy a malware toolkit named SCKit on at least 288 machines across 48 organizations. The attackers leveraged the flaw to install rogue ScreenConnect clients that maintain persistent remote access and attempt lateral movement via infected IT technician workstations. ConnectWise, owner of ScreenConnect, disabled vulnerable extensions in approximately 400 environments but confirmed no evidence of a vulnerability in ScreenConnect itself or compromise of its infrastructure. The malware also tries to reinfect and spread within managed service provider (MSP) customer networks. Administrators are urged to avoid remote investigations over ScreenConnect and to use alternative security tools to remove the infections properly.
Entenda a falha
A vulnerabilidade
No CVE is listed. Huntress traced the attacks to a possible authentication weakness in RMM+, a third-party ScreenConnect extension that lets other management tools issue commands without a technician using the console. In versions 1.0.31 and 1.0.32, installations with no configured access key accept a blank one. An attacker who can reach the instance could run commands on managed machines without defeating MFA, and in this campaign used that to install rogue ScreenConnect clients and the SCKit toolkit on at least 288 machines in 48 organizations. Attacks hit ScreenConnect 26.6.6.9747 and 26.7.6.9783. No fixed version is named; ConnectWise remotely disabled five extensions (including RMM+, RMM Plus and Labtech Plus) in about 400 environments. It says it found no vulnerability in ScreenConnect itself and has not confirmed how the attackers got in.
Como funciona
RMM+ exists so that other management tools can send commands through ScreenConnect to managed machines. A caller presents an access key to the extension, which then relays the command via ScreenConnect's remote command feature. The extension works outside ScreenConnect's normal user accounts and authentication, including MFA. When no key has been configured, a blank key is accepted, so the command is relayed anyway. Huntress saw commands reach machines across several installations with no matching login activity.
Por que é vulnerável
The root cause is a missing check in the extension's authentication: when no access key is configured, an empty key is treated as valid instead of being rejected. The design makes it worse, because RMM+ bypasses ScreenConnect's own accounts and MFA, so nothing else stands in the way. The articles do not describe a code-level fix; ConnectWise's response was to disable the extensions and urge customers with self-hosted servers to do the same.
Como foi descoberta
Huntress's security operations center spotted the attacks at around 1747 UTC, when rogue clients began appearing on machines managed by several IT service providers, and raised the alarm in a Reddit post on Wednesday. It later traced the activity to a possible authentication weakness in RMM+, matching what it saw in the attacks. ConnectWise published a security advisory about unauthorized access to some partner environments. Huntress suspects more MSPs were hit, since the attackers seemed to number victims sequentially.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
No published PoC is mentioned. What exists is the in-the-wild exploitation: the attackers pushed a 16-file toolkit called SCKit that installs a separate ScreenConnect client for persistence and tries to spread to the technicians investigating infected hosts and to other customers. All 288 endpoints were hit within 90 minutes. Huntress says that spread attempt has not succeeded so far. This is a working, weaponized attack, so patching and disabling the extensions is urgent.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 11:17.
Linha do tempo
-
Hackers Exploit Authentication Flaw in ScreenConnect Plugin to Deploy Malware on Hundreds of PCs
ler a análise desta fonte ocultar
An active hacking campaign exploited an authentication vulnerability in the RMM+ third-party extension for ScreenConnect, allowing attackers to bypass multifactor authentication and deploy a malware toolkit named SCKit on at least 288 machines across 48 organizations. The attackers leveraged the flaw to install rogue ScreenConnect clients that maintain persistent remote access and attempt lateral movement via infected IT technician workstations. ConnectWise, owner of ScreenConnect, disabled vulnerable extensions in approximately 400 environments but confirmed no evidence of a vulnerability in ScreenConnect itself or compromise of its infrastructure. The malware also tries to reinfect and spread within managed service provider (MSP) customer networks. Administrators are urged to avoid remote investigations over ScreenConnect and to use alternative security tools to remove the infections properly.