Huntress says attackers are using compromised ScreenConnect setups to reach MSP customers

Cybersecurity firm Huntress said on November 11, 2026 that it was tracking an active campaign against managed service providers (MSPs) that use ConnectWise’s ScreenConnect remote-access software. Attackers with access to a compromised MSP’s ScreenConnect environment are installing their own remote-access clients on customer devices. BleepingComputer reported the campaign the same day, with a statement from ConnectWise. Here’s what is known so far, and what MSPs and their customers should do.

What Huntress has seen

Huntress told Reddit that its security operations centre was working an active campaign that started around 17:47 UTC on November 11, targeting cloud-hosted ScreenConnect instances. At the time it posted, it was tracking six compromised MSPs and more than 286 endpoints across 47 organizations, “and those numbers are climbing.” It said ConnectWise was engaged and working with it.

According to Huntress, the attackers are using ScreenConnect’s Run Command feature to deploy ScreenConnect clients on managed endpoints. Those clients give the attackers remote access outside the legitimate MSP’s ScreenConnect environment.

Huntress has not yet said how the attackers first get into the affected MSP environments. Its current telemetry, it told BleepingComputer, points to compromised credentials and hijacked MSP support sessions. Sequential identifiers used by the attackers also suggest that other MSPs may have been compromised earlier, so even providers that have not had an alert are being asked to check their Run Command history.

The researchers also warned about a more dangerous possibility: an attacker could compromise an MSP technician’s own workstation if that technician starts a ScreenConnect session with an already infected customer device. It is not yet clear whether that reported reverse-pivot technique exploits a software vulnerability or abuses a legitimate feature.

Huntress has published indicators of compromise, including rogue ScreenConnect client IDs and infrastructure, to help organizations look for the activity.

What ConnectWise has said

In a statement to BleepingComputer, ConnectWise confirmed it is investigating.

“We are aware of reports of malicious activity affecting a limited number of ScreenConnect partners and are actively investigating,” the company said. “As a precaution, partners should avoid opening interactive ScreenConnect sessions to suspected compromised devices and use separate security tooling to investigate. Partners should also review account activity, revoke active sessions, reset credentials from a trusted device, and verify multifactor authentication.”

ConnectWise said it would share further information and guidance through the ConnectWise Trust Center.

This is a different incident from the October case in which stolen ConnectWise app keys were used to sign in to customer Microsoft 365 accounts.

What you can do

If you work at an MSP, or you run ScreenConnect yourself:

1. Follow ConnectWise’s precautions. Don’t open an interactive ScreenConnect session to a device you already suspect is compromised. Investigate with separate security tools.
2. Review account activity, revoke sessions, and reset credentials from a device you trust. Confirm that multifactor authentication is on.
3. Check Run Command history for unexpected ScreenConnect client installations, even if you have not had an alert.
4. Watch the ConnectWise Trust Center for official updates.

If you are a customer of an MSP and you don’t run ScreenConnect yourself:

5. You don’t need to change your own login details just because of this headline. If your provider contacts you, use a phone number or address you already have, not a link in an unexpected message.
6. If your computer starts showing unexpected remote-support prompts, contact your provider through a known channel and don’t approve a session you didn’t ask for.

How Frame helps

This campaign is aimed at MSP remote-access setups, not at a published list of personal email addresses, so there isn’t a breach record to add in Frame. Frame can also look up your verified emails in Have I Been Pwned’s breach database for other breaches. Frame doesn’t manage remote-support software.

Related coverage

• Stolen ConnectWise app keys signed in to customer Microsoft 365: an earlier ConnectWise incident that used stolen app permissions rather than rogue remote-access clients.
• A researcher published 33 N-central flaws with working exploits, and N-able took the service offline: another recent case involving remote-management software used by service providers.

Sources

• BleepingComputer, Active ScreenConnect attacks breach MSPs, impact dozens of organizations, November 11, 2026