ConnectWise ScreenConnect · Breach

ScreenConnect: Huntress reports 288 targeted endpoints across 48 organizations

Nov 11, 2026 · 1 min read

Attackers abused ScreenConnect partner accounts to distribute rogue clients delivering SCKit. Huntress reports at least 288 targeted endpoints across 48 organizations, while ConnectWise disabled five third-party extensions. Do not open interactive sessions to suspected hosts, and audit Run Command history and extensions.

By HIFY Radar newsroom Updated 11/12/2026 02:06 AM Get this every day →← Back to the feed 4 sources

HighBreachNo software to update

In 30 seconds

Alleged

The latest supplied report says Huntress counted at least 288 targeted endpoints across 48 organizations. ConnectWise disabled five third-party extensions as a precaution, while saying it had found no evidence of a compromise of its infrastructure or a vulnerability in ScreenConnect.

What happened

Alleged

Incident reports allege that unauthorized access to ScreenConnect partner accounts let attackers use the Run Command feature to install rogue ScreenConnect clients on managed endpoints. Those clients were then described as delivering SCKit malware.

Why it matters

Inferred

The apparent route through IT providers could turn access to one management environment into exposure across multiple customer networks. A separate warning says a technician opening an interactive session to an infected customer machine could also place the technician's workstation at risk.

What to do

Observed

The clearest guidance in the supplied reports is to avoid interactive sessions with suspected hosts and review ScreenConnect Run Command history and installed extensions. ConnectWise's disabling of five third-party extensions was described as precautionary, not proof that those extensions caused the incident.

Confirmed and still uncertain

Observed

ConnectWise says its initial review found no evidence that its own infrastructure was compromised or that a ScreenConnect software vulnerability was involved. The supplied evidence does not establish how the partner accounts were accessed, whether the disabled extensions were abused, or the campaign's final scope.

What people are saying

Alleged

Huntress is cited as tracking the affected endpoints and organizations, with early posts warning that the numbers were still climbing. ConnectWise's reported position is narrower: it acknowledged unauthorized-access reports and took precautions while rejecting, based on its initial assessment, evidence of a platform vulnerability or infrastructure compromise.

Evolution

Observed

Earlier posts cited more than 286 endpoints across 47 organizations. A later report raised the tally to at least 288 endpoints across 48 organizations, indicating that the reported scope grew by at least two endpoints and one organization during the available timeline.

Reach

Observed

5 independent groups, 5 updates, and 6 engagements.

Technical detail

Alleged

The reported mechanism used ScreenConnect's Run Command capability to push additional ScreenConnect clients to managed systems. Reports characterize those clients as rogue and link them to SCKit delivery, while the evidence supplied here does not independently verify the payload or show that a software flaw enabled installation.

Sources and evidence

Observed

The batch includes ConnectWise's trust-advisory page as the primary vendor reference, a report relaying the company's statement, and social summaries of Huntress's findings. Because the supplied ConnectWise item contains no advisory text, the scope figures, account-compromise claims and technical attack chain remain attributed rather than independently confirmed by the primary item in this dossier.