Attackers hijack ScreenConnect to target 48 organizations

First reported by BleepingComputer at · Updated · 3 sources

ConnectWise is investigating a campaign using compromised ScreenConnect environments to install rogue remote-access clients on MSP customer devices, according to BleepingComputer. Cyber Security News reports that Huntress identified a toolkit called SCKit deployed through cloud-hosted panels, with at least 288 devices affected within about 90 minutes.

  • Huntress first observed the activity on November 11, 2026, according to Cyber Security News.

Covered by 3 publishers within 12 hours of the first report.

Reporting3

BleepingComputer Active ScreenConnect attacks breach MSPs, impact dozens of organizations · Lawrence Abrams
Cyber Security News Hackers Hijack ConnectWise ScreenConnect to Deploy SCKit Malware Across 288 Devices at 48 Organizations · Guru Baran
SecurityWeek Hackers Deploy Malware in Fresh ScreenConnect Campaign · Ionut Arghire