Active ScreenConnect attacks breach MSPs, impact dozens of organizations

Update 11/11/26: Added additional information from ConnectWise and Huntress.

ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices.

As part of its investigation, ConnectWise has disabled five third-party ScreenConnect extensions across approximately 400 partner environments as a precaution, warning that they may be associated with the attacks.

The campaign was first discovered Wednesday by cybersecurity firm Huntress, which says it has identified six compromised MSPs and 286 affected endpoints across 47 organizations, and that the number of victims continues to rise.

"Our SOC is working an active campaign that started around 17:47 UTC today targeting cloud-hosted ScreenConnect instances," Huntress posted to Reddit.