An active malware campaign is targeting managed service providers (MSPs) through compromised ScreenConnect environments, as reported by cybersecurity firm Huntress on November 11, 2026. The campaign has affected six MSPs and 286 endpoints across 47 organizations.
Attackers are reportedly using ScreenConnect's Run Command functionality to deploy rogue clients on managed endpoints. This activity appears to abuse legitimate functionality rather than exploit a software vulnerability, according to Huntress.
ConnectWise has taken precautionary measures by disabling five third-party ScreenConnect extensions across approximately 400 partner environments. However, the company warns that this action does not remove any malicious software or unauthorized access that may already exist.
Huntress has not yet determined the method of access used by attackers but suggests that compromised credentials or hijacked operator sessions could be involved. Indicators of compromise (IOCs) have been shared to assist organizations in identifying malicious activity.
ConnectWise confirmed unauthorized access to partner accounts and the installation of unauthorized remote-access software. The company advises that disabling extensions alone is insufficient to address the threat.