Attackers got into cloud-hosted ScreenConnect panels on 11 November and used them to push a malware kit onto at least 288 computers at 48 organisations, security firm Huntress says. If you manage other people’s machines through ScreenConnect, check your panel’s command history now, whether or not an alert has fired.
The operator did not need an exploit on each target. They used the panel’s Run command to send instructions to many machines in one go, running with SYSTEM rights, and each machine then installed the attacker’s own ScreenConnect client and a toolkit called SCKit.
Huntress first saw the activity at about 17:47 UTC. Every one of the 288 machines was hit within 90 minutes, and about a third of them in the first 10 minutes. SCKit arrives as an encrypted bundle of 16 files, mostly scripts, and the attacker’s server hands each machine its own decryption key when it asks.
ConnectWise, which makes ScreenConnect, posted an advisory at 22:45 UTC the same day naming five third-party extensions that may be linked to the activity: Labtech Plus, RMM Plus, RMM+, and the Password Link versions of the last two. It disabled them across 400 partner environments as a precaution, and said it had not yet found how the attackers got in or how far it reaches. Huntress lists 26.6.6.9747 as affected, along with 26.7.6.9783, the newest two releases.
On each machine the kit stops the real ScreenConnect client, sets it to start manually and slides the attacker’s copy into its place, so the computer still looks normal to the panel. It also adds Defender exclusions and a scheduled task named TrapWatch.
A second stage is built to spread further: when a technician connects to an infected machine, it steals their session cookie and tries to use it to push the same payload to every machine that technician can reach. So far that step has stayed on paper: Huntress has seen it tried on the machines it could examine and fail each time.
That design shapes the advice. Huntress’s first rule is to stay out of ScreenConnect when examining a suspect machine: a technician’s own session is the route the malware is built to use for its next hop. Reach the machine with EDR live response, WinRM or a similar tool outside ScreenConnect. Cutting a machine off the network is not a fix either, because some came back infected soon after being reconnected. The rogue client service, the TrapWatch task and the C:\ProgramData\RelayTrap folder all have to go, and ScreenConnect credentials and browser sessions should be rotated from a clean device.
It is the second wave of its kind. Huntress also dealt with similar self-spreading activity on ScreenConnect in September 2026, and ConnectWise later fixed a file-transfer flaw, CVE-2026-84869, rated 9.9 on the CVSS scale. Hash matching will miss most of it, Huntress warns: the scripts are regenerated, and every host compiles its own trap program. Defenders are told to look for bulk Run Command and Toolbox runs nobody ordered, and for a second ScreenConnect client on managed machines.
