An operator pushed commands through cloud-hosted ScreenConnect panels on 11 November and installed rogue ScreenConnect clients plus a toolkit called SCKit on 288 endpoints belonging to 48 organisations. All 288 hosts were hit inside 90 minutes, and about a third of them within the first 10 minutes.
What happened
Huntress detected the activity at 17:47 UTC and traced most of it to RMM+, a third-party ScreenConnect extension. Versions 1.0.31 and 1.0.32 accept a blank access key when an administrator has never configured one, so a caller that sends no key passes the authentication check. RMM+ sits outside ScreenConnect's own user accounts, roles and MFA, which is why the commands arrived across several instances with no matching login activity in the panel logs.
ConnectWise disabled five third-party extensions across roughly 400 partner environments as a precaution: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link. On-premises partners have to remove them by hand, and the company warned that disabling an extension does not clean up access an attacker already established.
SCKit is a 16-file package of PowerShell, batch and cmd scripts. One component uploads a payload to the panel's Shared Toolbox, which makes every reachable session run it as SYSTEM, then deletes the toolbox item about a minute later. A second component, RelayTrap, relays session cookies so an operator can ride an existing technician session. The kit also carried an exploit for CVE-2026-84869, a CVSS 9.9 guest-to-host file execution flaw in the ScreenConnect client that was fixed in 26.6.5; Blackpoint reproduced that attempt against a current client and the fix blocked it.
Who is affected
The builds in scope include 26.6.6.9747 and 26.7.6.9783, so running the latest release does not remove the extension problem.
- MSPs and internal IT teams running cloud-hosted ScreenConnect with any third-party extension installed.
- On-premises ScreenConnect servers, where ConnectWise cannot disable extensions for you.
- Customer endpoints reachable from a compromised panel, and the technician workstations that connect to them.
What to do now
Remove the five named extensions now and treat anything a compromised panel could reach as suspect.
- Check extension installation records and remove RMM+, RMM Plus, Labtech Plus and both password-link extensions. Do not reinstall them until ConnectWise clears them.
- Review Run Command history, Toolbox items, administrative activity and authentication logs for commands nobody on your team sent.
- Look for ScreenConnect clients installed outside your own instance, and compare hosts against the attacker infrastructure Huntress published.
- Do not open an interactive session to a suspect endpoint. Investigate it with a separate tool and rotate every credential the panel could reach.
What this means for South African businesses
A remote management console is the highest-value foothold in an SME estate, because one compromised panel reaches every client at once, and South African MSPs routinely leave trial or project extensions enabled long after the job that needed them ended. A blank default access key on an internet-facing panel is effectively no authentication, so the real exposure is wider than the 48 organisations counted here. Every third-party extension in an RMM deserves a named owner and a review date.
Source: Huntress - SCKit worm installs rogue ScreenConnect clients.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.