Ongoing Attacks Targeting ScreenConnect Extensions

The Threat

On November 11th, 2026, ConnectWise published an advisory warning of unauthorized access to ScreenConnect partner accounts leading to the deployment of rogue ScreenConnect clients and further malicious payloads. ConnectWise linked the activity to five independent third-party extensions: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. ConnectWise has disabled these extensions for partner accounts but states that on-premises partners will need to manually disable the extensions.

Organizations that utilize ScreenConnect should perform an audit to determine if the impacted extensions are installed, and if so, confirm that they have been disabled.

What we're doing about it

• eSentire's Threat Response Unit (TRU) is performing threat hunts for known Indicators of Compromise (IoCs)
  • Impacted customers will be contacted by the eSentire SOC
• IP addresses associated with this activity have been blocked via eSentire's Global Block List available to eSentire MDR for Network customers
• eSentire's TRU team is continuing to track this topic for additional information and detection opportunities

What you should do about it

• Perform an audit to determine if the impacted extensions are utilized within your environment and if so, verify the extension status
  • On-premises customers will have to manually disable the extensions if found
  • Disabling or removing extensions will not remove any unauthorized software, persistence mechanisms, or previously established access
• Avoid interactive ScreenConnect connections to suspected compromised devices
  • Impacted devices should be isolated and remediated before connectivity is restored
• On impacted devices:
  • Terminate active ScreenConnect web sessions
  • Rotate affected credentials, including exposed browser and identity-provider credentials
  • Audit ScreenConnect Run Command history and audit logs for unknown command executions and for other potentially impacted systems

Additional Information

On November 11th, security researchers identified in-the-wild attacks leveraging an authentication flaw within the RMM+ extension, which bypasses ScreenConnect's user accounts, roles, and Multi-Factor Authentication (MFA), and authenticates with a shared access key in the extension's settings. In versions 1.0.31 and 1.0.32 of RMM+, a blank access key would be accepted if one had not previously been configured. Observed attacks saw the deployment of rogue ScreenConnect clients and the SCKit toolkit, which is used to establish persistence and steal data from infected hosts, including browser and ScreenConnect session tokens.

Further investigation into the SCKit code found that it can spread via ScreenConnect sessions, suggesting that the malware can spread to a technician's device and then any other devices that they connect to, if not properly remediated. As such, organizations should not establish any ScreenConnect sessions to devices that are suspected of being infected, and impacted devices should be remediated using alternate means.

Organizations that utilize the impacted extensions should ensure that they have been disabled or removed. The extensions should not be reenabled or reinstalled until further guidance is provided by ConnectWise.

References

[1] https://www.connectwise.com/company/trust/advisories
[2] https://www.huntress.com/blog/sckit-worm-rogue-screenconnect