ConnectWise disables five ScreenConnect add-ons after a worm

ConnectWise disables five ScreenConnect add-ons after a worm

11 November 2026: ConnectWise has switched off five third-party ScreenConnect extensions in the partner environments it hosts, after attackers used them to push rogue remote-access clients to customer machines, and has told on-premises partners to disable them at once. Huntress, which investigated, counted at least 288 hosts in 48 organisations reached within about 90 minutes on 11 November.

Not yet independently verified. ConnectWise says the initial access method and full scope are still under investigation. The host and organisation counts are Huntress's, from its own customers only, and we could read Huntress's post only through our sweep, not live. We will update this when it can be confirmed, and remove this note.

How the extensions were abused

The extensions ConnectWise names are Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link, independent add-ons rather than ConnectWise code. It found about 400 partner environments with at least one installed, and says their presence alone does not establish compromise.

Huntress says the activity is linked to RMM+ versions 1.0.31 and 1.0.32: where an administrator had never set an access key, the extension accepted a blank one, which bypassed ScreenConnect accounts, roles and multi-factor authentication. From about 17:47 UTC, the attackers used the Run command on cloud-hosted ScreenConnect panels to install rogue ScreenConnect clients and a 16-file toolkit Huntress calls SCKit, which sets up a relay to capture session cookies. In every host log recovered so far, the attempt to take over technician workstations failed. The panels involved ran current ScreenConnect versions, 26.6.6.9747 and 26.7.6.9783, so this is not a missing patch.

ConnectWise says its "initial assessment suggests the activity may involve a threat actor's abuse of independent third-party extensions", and that the initial access method and full scope "remain under investigation".

What partners must do now

• On-premises partners: disable all five extensions immediately, verify they are disabled, and do not re-enable or reinstall them until ConnectWise says otherwise.
• Cloud partners: ConnectWise has disabled them where it can; confirm in the admin panel.
• Where compromise is suspected: isolate the devices, and from a trusted device revoke active ScreenConnect and identity-provider sessions and reset credentials.

ConnectWise warns that disabling the extensions "may not remove unauthorized access already established on endpoints". It also asks partners not to open interactive ScreenConnect sessions to devices they suspect, and to investigate with separate security tooling instead.

Signs to look for

Check each customer device for a second ScreenConnect client that the partner did not deploy, for unexpected remote commands and Toolbox activity, and for new administrator accounts. The extension rule is the lesson for any remote-access platform: an add-on with its own authentication can sidestep the multi-factor setup of the product it plugs into.

The incident follows a September worm-like campaign against ScreenConnect that Huntress also responded to, after which ConnectWise fixed CVE-2026-84869, a critical file-transfer flaw rated 9.9.

ConnectWise ScreenConnect is one of 17 products in our remote support software category.

Sources

• ConnectWise: ScreenConnect security update, guidance for partners, 11 November 2026
• Huntress: SCKit worm and rogue ScreenConnect clients, 11 November 2026