Hackers Hijacked IT Providers' Remote-Support Tool and Hit 288 PCs at 48 Businesses in 90 Minutes

The remote-support tool your IT provider uses to fix your computers can also be used to break into all of them at once. On Wednesday, November 11, attackers got into ConnectWise ScreenConnect panels run by several managed IT providers and used them to push malware to at least 288 computers across 48 organizations. Huntress says every one of those machines was hit within about 90 minutes, and roughly a third in the first ten minutes.

• What happened: attackers used ScreenConnect's "Run Command" feature to install a second, rogue ScreenConnect client on managed PCs, so they keep access even if the real connection is shut off.
• How they likely got in: Huntress traced the activity to a possible weakness in RMM+, a third-party extension. Versions 1.0.31 and 1.0.32 can accept a blank access key when none was set, and because the extension runs outside ScreenConnect's normal logins, MFA may not stop it. Huntress also points to stolen credentials or hijacked sessions. The full access path is still under investigation.
• What ConnectWise did: it found about 400 partner environments with at least one extension from that family and disabled five of them remotely (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link). It says it has found no compromise of its own infrastructure and no flaw in ScreenConnect itself, and that having an extension installed does not mean an environment was breached.

Why it matters for your money

Most small businesses never see their IT provider's tools, but those tools usually have administrator rights on every computer in the office. When one is abused, an attacker doesn't need to phish each employee; one command reaches every machine. The malware in this campaign, which Huntress calls SCKit, adds Microsoft Defender exclusions, plants a scheduled task, and is built to try to spread to the technician who connects to clean it up. Huntress says it has not yet seen that last step succeed, but it also saw some machines reinfected within minutes of being brought back online because the cleanup was incomplete. Every hour your office can't work, and every machine that has to be rebuilt, comes out of your revenue.

The attackers also numbered the IT providers they hit, and the numbers Huntress saw started partway through the sequence. That suggests other providers may have been hit earlier.

What to ask your IT provider this week

1. "Do you use ScreenConnect, and did you have RMM+, RMM Plus or Labtech Plus installed?" If yes, ask whether they have reviewed the Run Command history, even if they got no alert.
2. "Are there any remote-access programs on our PCs that we didn't approve?" Ask for a list of every remote tool installed on your machines and who can use it.
3. "Is MFA required for every technician login, and are unused technician accounts removed?"
4. "How would you clean up an infected PC without connecting to it the same way?" ConnectWise and Huntress both warn against investigating through ScreenConnect itself.
5. Tell your staff: treat any unexpected "IT support" call, password-reset message or software download as suspicious until you confirm it with your IT contact at a number you already have.

If you manage your own computers and have never checked what remote-access software is installed, now is a good time to look.

Nice2GeekYou is based in San Antonio and serves all of Texas on site, and our managed IT plans cover remote clients across the U.S. We limit who can reach your computers remotely, require MFA on our own access, and keep an inventory of what's installed on every machine. Request a quote, see our monthly plans, or text us at (210) 504-8969.

Sources: The Hacker News — ScreenConnect attacks target at least 288 endpoints across 48 organizations with rogue clients (November 12, 2026); The Register — Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs (November 12, 2026).