Hackers are running an active campaign that abuses ScreenConnect environments to gain access and deliver malicious capabilities to endpoints. Reporting describes attackers bypassing ScreenConnect authentication via a vulnerability in a legitimate extension, then using compromised setups to deploy rogue remote-access clients to devices managed by others.
ConnectWise is investigating the activity and says it has taken precautionary steps, including disabling several third-party extensions in partner environments after reports of unauthorized access. The company’s advisory, as summarized by one outlet, indicates there is no evidence that ConnectWise’s infrastructure is compromised or that ScreenConnect software itself is vulnerable.
Outlets differ mainly in emphasis and scale details available from their summaries. One report focuses on the malware campaign mechanics and the use of a compromised extension to reach authentication. Another highlights reported reach across organizations and endpoints, while a third frames the impact as MSP-focused and affecting dozens of organizations, describing outcomes in terms of customer device compromise rather than infrastructure breach claims.
