Security AlertCritical
ScreenConnect attacks hit MSPs and dozens of customer organizations
Nov 11, 2026 · Summarized by Fundy Tech from BleepingComputer
The 30-second version
ConnectWise is investigating active attacks using compromised ScreenConnect environments to deploy rogue remote-access clients. Huntress says it has found six compromised MSPs and 286 affected endpoints across 47 organizations.
Key points
- Huntress says victims keep rising across 47 organizations.
- Attackers used ScreenConnect Run Command to install rogue clients.
- ConnectWise told partners to avoid interactive sessions with suspect devices.
- Current telemetry points to compromised credentials and hijacked support sessions.
Why it matters
Small businesses that rely on MSPs could have their support tools abused for remote access. If your IT provider uses ScreenConnect, this is a good time to review sessions, credentials and MFA settings.
Who’s affected: MSPs and their customer endpoints
What to do
- Review active remote-access sessions.
- Reset credentials from a trusted device.
- Verify multifactor authentication is on.
- Check ScreenConnect Run Command history.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.