Hackers Exploit ScreenConnect RMM+ Flaw, Deploy Malware Across Dozens of Organisations

A threat actor has compromised hundreds of endpoints across dozens of ConnectWise ScreenConnect customers by exploiting a vulnerability in a third-party extension. The attackers leveraged an authentication bypass flaw in the RMM+ extension to gain unauthorised access and deploy a sophisticated malware toolkit.

Cybersecurity firm Huntress first reported the campaign on 11 November 2026, observing rapid attacks that impacted at least six managed service providers (MSPs) and 288 hosts across 48 organisations. The compromise of all affected hosts occurred within a tight 90-minute window.

RMM+ Extension Flaw Enabled Authentication Bypass

The attackers exploited a vulnerability in the RMM+ extension, a legitimate tool designed for managing ScreenConnect sessions. The flaw, present in RMM+ versions 1.0.31 and 1.0.32, allowed threat actors to bypass ScreenConnect’s authentication mechanism. This was possible because the extension’s shared access key would default to a blank value if an administrator had not specifically configured it, effectively accepting an empty key for authentication.

Huntress’s analysis indicated that many RMM+ installations, often deployed for specific projects, had been left in place with this critical misconfiguration. The speed of endpoint compromise and the absence of corresponding login activity in logs, instead pointing to RMM+ activity, led researchers to pinpoint the extension as the attack vector.

SCKit Malware toolkit Deployed for Persistence

Once unauthorised access was established via the compromised ScreenConnect panels, the attackers deployed rogue ScreenConnect clients and a custom malware toolkit dubbed SCKit. This toolkit is designed to provide persistent backdoor access, intercept session cookies, and self-replicate. Initial deployment targets compromised endpoints, waiting for a technician to connect, then attempts to infect the technician’s workstation and spread to other sessions they manage.

In response to the identified threat, ConnectWise disabled five extensions from the RMM+ family across approximately 400 ScreenConnect environments. These included Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. ConnectWise affirmed that the mere presence of these extensions does not indicate compromise, but acknowledged their API’s capability to execute remote commands, protected only by a partner-configured passphrase.

Both Huntress, in its official advisory, and ConnectWise have released indicators of compromise (IoCs) associated with the campaign. Organisations operating on-premises ScreenConnect deployments are strongly advised to disable the specified RMM+ extensions as a critical mitigation step and review their systems for any signs of compromise.