--- id: "CMP-202611-s74c66" page: "https://infrastack.ai/live/CMP-202611-s74c66" kind: "campaign" aliases: [] title: "Attackers use hijacked cloud-hosted ScreenConnect accounts at MSPs to push rogue ScreenConnect clients to customer devices; 6 MSPs, 286+ endpoints at 47 organizations (Huntress, ConnectWise investigating)" severity: "critical" cvss: null epss: null exploited: true status: "open" category: "vendor" products: [{"name": "ScreenConnect", "fixed": [], "vendor": "ConnectWise", "affected": "cloud-hosted instances (method of access unknown)"}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-11T23:25:36+00:00" updated_at: "2026-11-11T23:26:20+00:00" sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-11T23:25:36+00:00"}] exploit_sources: [] --- # Attackers use hijacked cloud-hosted ScreenConnect accounts at MSPs to push rogue ScreenConnect clients to customer devices; 6 MSPs, 286+ endpoints at 47 organizations (Huntress, ConnectWise investigating) Link for people: https://infrastack.ai/live/CMP-202611-s74c66 (this .md is for agents) Since about 17:47 UTC on 11 Nov 2026, Huntress's SOC has been tracking an active campaign against cloud-hosted ConnectWise ScreenConnect instances run by managed service providers. Attackers use ScreenConnect's Run Command feature to install their own ScreenConnect clients on the MSP's managed endpoints, which gives them remote access outside the MSP's own ScreenConnect. Confirmed so far: 6 MSPs, 286+ endpoints at 47 organizations, and the count is rising. How they get in is unknown; Huntress's telemetry points to stolen credentials and hijacked MSP support sessions. Huntress also warns of a reverse pivot: a technician's workstation can be compromised when they open a ScreenConnect session to an infected customer device (it is unclear whether this is a bug or abuse of a feature). Sequential tags assigned by the attackers suggest other MSPs were compromised earlier. ConnectWise confirms it is investigating. BleepingComputer found one of the rogue client IDs in a Social Security-themed batch script uploaded to VirusTotal on 25 Jul 2026; it is unclear whether that is the same campaign. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - :ScreenConnect affected cloud-hosted instances (method of access unknown) fixed no fixed version listed ## Cause How the attacker got in: not disclosed yet (unknown). The record states 'How they get in is unknown' and says Huntress's telemetry only 'points to' stolen credentials and hijacked MSP support sessions, while the attackers use those hijacked MSP accounts to install rogue ScreenConnect clients on customer devices. How it reached others: credentials stolen there were used against others (stolen-credential). Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#stolen-credential ## How to check MSPs and IT teams on ScreenConnect (cloud-hosted especially): check the Run Command history and audit log for commands you did not run that install ScreenConnect clients, even if you have had no alerts. On endpoints, look for ScreenConnect client services/folders (C:\Program Files (x86)\ScreenConnect Client ()) with an ID that is not your instance's, in particular rogue client ID ed630cc2c873b091. Network: digitaldownloads[.]com (Huntress lists it as a potential IOC) and amexsafekeyupdate[.]com (in the July batch script). Huntress has shared more client IDs and infrastructure; that list was not in the source we read (unknown here). ## Fix Do not open interactive ScreenConnect sessions to devices that may be compromised; investigate them with separate security tools (ConnectWise guidance). Review ScreenConnect account activity, revoke active sessions, reset ScreenConnect credentials from a trusted device, and check that MFA is enforced on every account. Remove rogue ScreenConnect clients and block the IOC domains. Follow the ConnectWise Trust Center for updates. Customers of MSPs: ask your MSP whether it is affected and check for unknown ScreenConnect clients. ## Timeline - 2026-11-11T23:25:36+00:00 analyst ## Documents - [describes] @BleepinComputer: 🚨 Hackers are breaching MSPs through compromised ScreenConnect panels, deploying https://x.com/BleepinComputer/status/2120652762501275700 - [describes] BleepingComputer: Active ScreenConnect attacks breach MSPs, impact dozens of organizations https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/ --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_