ConnectWise has disabled five third-party extensions as a precaution after reports of unauthorized access to partner environments, The Hacker News reported on November 12, 2026. Huntress observed attackers issuing commands through cloud-hosted ScreenConnect management panels to install unauthorized remote-access clients, targeting at least 288 managed endpoints across 48 organizations.
The response affects partners using Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link or RMM+ Password Link. ConnectWise found at least one of these extensions in about 400 partner environments, a count of installations that does not establish how many environments were compromised. Partners hosting ScreenConnect on their own premises have been urged to disable the extensions themselves.
In its advisory, as reported by The Hacker News, ConnectWise said its preliminary assessment pointed to possible abuse of independent third-party extensions. It was still investigating both the entry method and the scope, with no evidence that its infrastructure had been compromised or that a ScreenConnect vulnerability was involved. The extensions allow software to issue remote commands through an application programming interface, or API, protected by a passphrase the partner chooses during setup.
Unauthorized clients provide a separate foothold
Huntress first detected the activity at approximately 5:47 p.m. UTC on November 11, 2026. The company told The Hacker News that its telemetry suggested stolen credentials or hijacked operator sessions could explain access to the panels, although the entry method remained unresolved and it had seen no evidence of a new vulnerability.
Once inside a panel, an attacker can use its Run Command feature to install an attacker-controlled ScreenConnect client on managed devices. That installation gives the attacker continuing access without relying on the original panel.
Huntress researchers Ben Nahorney and Susannah Matt identified SCKit as the malicious toolkit delivered by the rogue clients. Alongside persistent remote access, it sets up a trap intended to intercept session cookies, the browser data used to maintain signed-in sessions.
The toolkit arrives through an encrypted payload and sckit-run.bat, a dropper—a script that retrieves further malware—encoded with Base64, a way of representing data as text. The batch script requests sckit-decoder.ps1 from a remote server; that PowerShell script starts SCKit. Additional components are built to exclude files or locations from Microsoft Defender scanning, add another attacker-controlled ScreenConnect client, register a scheduled task called TrapWatch, and substitute an attacker-controlled installation for the legitimate one.
The report also described signs of possible large language model involvement in at least one script, based on detailed code references and comments explaining its operation.
A spreading mechanism reconstructed from the files
Huntress’s analysis identified a worm-like design that could turn a technician’s connection into a route to more devices. An infected endpoint could pass malware to a connecting technician’s workstation, where saved browser sessions and authentication tokens could expose other ScreenConnect panels. Those tokens are credentials that software uses to authorize access.
This spreading capability came partly from analysis of the payloads: Huntress had not observed a successful transfer from an infected endpoint to a technician’s workstation, or onward from that workstation to other endpoints.
The reconstructed sequence begins with Run-Lateral-Full.bat. It uses the connection to reach ns.mo7sen[.]dev and retrieve a loader, which collects the workstation’s unique identifier and sends it to the attacker. The response supplies an encrypted toolkit customized for that workstation.
Two scripts, Panel-Lateral.ps1 and LabConfig.ps1, work together to take the .aspxauth session cookie. They attempt to present it to the panel as an authenticated session and obtain the tokens needed to list other sessions accessible to the technician.
Next, ToolboxRelayUploader.exe uses the resulting access to place WithUninstall.ps1 in the panel’s Shared Toolbox. A request through the panel directs every reachable session to execute that item. The payload is designed to run under SYSTEM, a highly privileged Windows account, and install the trap on those endpoints. About 60 seconds after that broadcast, the uploader removes the Toolbox item.
Huntress also found sequential number tags assigned to compromised managed service providers, businesses that administer customer systems. Because the observed numbering began partway through the sequence, the researchers suggested that other providers might have been compromised earlier.
Sophos records a matching installation pattern
A separate Sophos alert described unauthorized ScreenConnect deployments originating from three instance IDs suspected of being compromised: d905b2b1b165d0a9, 4b8f4089ddaac6a9 and df1f7ef0cfacd0d8. The additional malicious instances deployed through this activity had IDs 2588ef5c15954b10 and ed630cc2c873b091.
One observed installation used Curl.exe to retrieve ScreenConnect.ClientSetup.msi from 185.99.255[.]28 and save it as C:\Windows\TEMP\sc.msi. A command file generated by ScreenConnect then invoked msiexec.exe to install the package silently. Sophos also saw scripts placing batch files on systems and running PowerShell with execution-policy bypass to fetch a second-stage script from ns[.]mo7sen[.]dev/EadF.php?p=4.
Checks for partners and technicians
ConnectWise supplied the following indicators of compromise—addresses and files that can help investigators look for related activity:
- IP addresses:
185.99.255[.]28,155.94.150[.]39 - Domains and URL:
ns[.]mo7sen[.]dev,ns[.]mo7sen[.]dev/EadF.php?p=4,sc[.]payproofkit[.]com,cdn007-digitaldownloads[.]com,newnewnew[.]gotdns[.]org,Soxnewwork[.]homedns[.]org - Files:
sckit-run.bat,sckit-decoder.ps1,TrapWatch.ps1,Panel-Lateral.ps1,Run-Lateral-Full.bat,runnew.cmd,ToolboxRelayUploader.exe,Sqlite3.exe
All partners should verify that their security controls are operating and retain logs showing suspicious activity, ConnectWise recommends. Its guidance calls for reviewing:
- Sign-ins from unfamiliar locations, repeated authentication failures and unexpected multi-factor authentication prompts, which request an additional sign-in verification.
- Newly created administrator accounts and altered user permissions.
- Unanticipated extension installations, remote commands and Toolbox operations.
- Remote-access software without approval on customer devices or technician workstations.
- Unexpected support requests, password-reset messages and software downloads arriving through a trusted channel.
Partners with on-premises deployments should disable the five extensions identified by ConnectWise. ScreenConnect users should also inspect their Run Command history even when no alert has fired.
