ScreenConnect Extension Flaw Fuels Malware Campaign Hit 288 Endpoints

In a coordinated effort that began on November 11, attackers used a weakness in the RMM+ extension for ConnectWise’s ScreenConnect remote-support tool to push a malware kit called SCKit onto 288 endpoints in 48 companies. The campaign was uncovered by Huntress, which reported that the malware was installed on 288 machines within 90 minutes of the first command, with a third of the infections occurring in the first ten minutes.

• Huntress traced the attacks to a blank-key authentication flaw in RMM+ versions 1.0.31 and 1.0.32.
• ConnectWise disabled five RMM+ family extensions in roughly 400 ScreenConnect environments.
• Administrators are advised to avoid remote connections via ScreenConnect when investigating infections.

How the Attack Unfolded

According to Huntress, the attackers first gained unauthorized access to cloud-hosted ScreenConnect panels. Once inside, they issued remote-command instructions that installed rogue ScreenConnect clients and the SCKit toolkit on each target. The toolkit includes a separate ScreenConnect client that keeps a foothold even if the legitimate session is terminated. It also contains code designed to steal session cookies and, in theory, to spread from one technician’s workstation to other customers under the same IT service provider.

Exploiting the RMM+ Authentication Bug

The core of the campaign was a vulnerability in the RMM+ extension, which allows third-party management tools to issue commands through ScreenConnect. Versions 1.0.31 and 1.0.32 default to an empty access key if none is configured, letting an attacker bypass ScreenConnect’s multi-factor authentication. Huntress noted that the attackers exploited this flaw to run commands on managed endpoints without any corresponding login activity in the logs.

ConnectWise’s Response and the Scale of Impact

ConnectWise identified about 400 ScreenConnect installations that had at least one RMM+ family extension. In a security advisory, the company disabled five extensions—RMM+, RMM Plus, Labtech Plus, RMM Plus Password Link, and RMM+ Password Link—across those environments and urged on-premises customers to do the same. The advisory clarified that the presence of the extensions alone does not prove compromise, but the extensions provide an API that can execute remote commands if the passphrase is known or defaulted.

What the Malware Can Do and What It Hasn’t Yet Done

SCKit is a 16-file toolkit that installs a persistent backdoor, captures session cookies, and can self-replicate. Huntress observed that the malware attempts to turn an infected computer into a trap for technicians: if a technician connects via ScreenConnect, the toolkit tries to copy malware back to the technician’s workstation and use that access to infect other machines. However, Huntress has not seen this console-takeover functionality succeed in any recovered host logs.

Next Steps for Administrators

Both Huntress and ConnectWise recommend that administrators avoid investigating suspected infections by remotely connecting through ScreenConnect, as doing so could expose the technician’s machine. Instead, they should use other security tools to scan for rogue ScreenConnect clients, review command logs, and remove any lingering malware. Simply disabling the vulnerable extensions will not erase persistence mechanisms or unauthorized software already installed.

Why This Matters for IT Teams and Businesses

ScreenConnect is widely used by managed service providers to support client networks. The attack demonstrates that a flaw in a third-party extension can give attackers a foothold across multiple customers without needing to compromise the core application. For businesses that rely on remote-support tools, the incident underscores the importance of monitoring extension configurations, enforcing strong access keys, and keeping all components—including third-party plugins—up-to-date. It also highlights the need for incident-response plans that avoid using the compromised channel for troubleshooting.