ConnectWise is investigating reports that a threat actor is manipulating third-party extensions within ScreenConnect environments to execute malicious remote commands against end users, according to a recent report by Channeldive.
The company has disabled access to specific extensions across 400 partner environments as a precaution. Cybersecurity firm Huntress reported that attackers installed rogue ScreenConnect clients on 288 endpoints across 48 organizations to deploy a toolkit known as SCKit. This toolkit utilizes 16 files, including PowerShell and batch scripts, to facilitate a multistage infection process. The attacker leverages the ScreenConnect Run command to establish persistent remote access and potentially steal session cookies.
Researchers from Sophos and BlackPoint are also monitoring similar unauthorized deployments. BlackPoint noted that the activity may involve a vulnerability tracked as CVE-2026-84869, which the Cybersecurity and Infrastructure Security Agency added to its known exploited vulnerabilities catalog in September. ConnectWise has urged partners to disable third-party extensions, revoke active sessions, and implement multifactor authentication to secure their environments.
The company emphasized that on-premises partners must manually disable these extensions, as the provider cannot take unilateral action for those specific installations. Industry experts continue to analyze the scope of this campaign to determine if the identified vulnerability was the primary entry point for the attackers.
Source: Channeldive
