Update 11/11/26: Added additional information from ConnectWise and Huntress.
ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices.
As part of its investigation, ConnectWise has disabled five third-party ScreenConnect extensions across approximately 400 partner environments as a precaution, warning that they may be associated with the attacks.
The campaign was first discovered Wednesday by cybersecurity firm Huntress, which says it has identified six compromised MSPs and 286 affected endpoints across 47 organizations, and that the
We don’t just report the news, we deliver it through the voices of multiple expert staff writers, each selected to broaden our scope and deepen our storytelling.
