ConnectWise said it is investigating reports that a threat actor is manipulating third-party extensions in ScreenConnect environments to execute malicious remote commands against end users.
In a precautionary measure, ConnectWise has disabled access to RMM+ extensions at about 400 environments. The company advises on-premises partners to disable their third-party extensions because it cannot take unilateral action in those instances.
“While the initial access method remains unconfirmed, our initial assessment suggests the activity may involve a threat actor’s abuse of independent third-party extensions installed in partner environments,” the company said in a statement.
Huntress, a Maryland-based cybersecurity firm, said that an attacker has installed rogue ScreenConnect clients on at least 288 managed endpoints across 48 different organizations, according to a blog post. The rogue client then installs a malicious toolkit called SCKit into those environments.
“The attacker is abusing ScreenConnect to establish persistent remote access on victim environments and install malware that could potentially steal session cookies,” Susannah Matt, technical content specialist at Huntress, told Cybersecurity Dive.
The attacker uses the ScreenConnect Run command to deploy the malicious toolkit. SCKit contains a package of 16 files, including PowerShell scripts, batch scripts, Windows command line files and other files to allow the infection to spread in a multistage process, according to Huntress researchers.
Sophos researchers are investigating similar activity involving unauthorized ScreenConnect deployments, according to a blog post.
Researchers at BlackPoint claim the toolkit uses a Relay/Trap component that is aimed at technicians who might attempt to connect to the affected machine, according to a blog post.
BlackPoint researchers said the “guest-to-host” behavior is associated with a previously disclosed vulnerability, tracked as CVE-2026-84869. The Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog in September. Researchers have not yet established whether the bug has been successfully exploited in this campaign.
ConnectWise said the disabled extensions include Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM + Password Link.
ConnectWise recommended partners take the following steps:
- Confirm that third-party extensions are disabled.
- Use separate tooling to investigate suspected compromise. (In other words, don’t use interactive ScreenConnect sessions to investigate.)
- Secure administrative access from a trusted device. Revoke active ScreenConnect sessions, revoke passwords and use multifactor authentication.
- Preserve evidence, including authentication, extension installation, Run command and Toolbox records.
