---
title: Active campaign hits MSPs through ScreenConnect: Run Command pushes rogue clients to customer hosts, and a trap targets technicians who connect | ctxsec
url: https://ctxsec.com/items/screenconnect-msp-campaign-run-command-rogue-clients-technician-trap-nov-11
description: "Starting around 17:48 UTC on Nov 11, attackers with access to MSPs' ScreenConnect instances used the Run Command feature to install a second, attacker-controlled ScreenConnect client and a PowerShell toolkit on every host they could reach. Huntress says the toolkit adds a SYSTEM scheduled task and a modified client that waits for a technician to connect, then delivers the toolkit to that technician. BleepingComputer reports Huntress counted 6 compromised MSPs and 286 endpoints across 47 organizations, and rising. ConnectWise says it disabled five third-party extensions (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, RMM+ Password Link) in about 400 partner environments as a precaution, suspects they were used to deploy the extra remote-access software, and says the initial access method and scope are not yet established."
status: "official (ConnectWise Trust Center advisory and Huntress incident notice, Nov 11, 2026); active campaign, initial access not yet established"
published: 2026-11-11
---

> Starting around 17:48 UTC on Nov 11, attackers with access to MSPs' ScreenConnect instances used the Run Command feature to install a second, attacker-controlled ScreenConnect client and a PowerShell toolkit on every host they could reach. Huntress says the toolkit adds a SYSTEM scheduled task and a modified client that waits for a technician to connect, then delivers the toolkit to that technician. BleepingComputer reports Huntress counted 6 compromised MSPs and 286 endpoints across 47 organizations, and rising. ConnectWise says it disabled five third-party extensions (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, RMM+ Password Link) in about 400 partner environments as a precaution, suspects they were used to deploy the extra remote-access software, and says the initial access method and scope are not yet established.

[← Cybersecurity News](/news) · [markdown](/items/screenconnect-msp-campaign-run-command-rogue-clients-technician-trap-nov-11.md)

official (ConnectWise Trust Center advisory and Huntress incident notice, Nov 11, 2026); active campaign, initial access not yet established

2026-11-11 7:41 PM ET

### Active campaign hits MSPs through ScreenConnect: Run Command pushes rogue clients to customer hosts, and a trap targets technicians who connect

- **Do now (both vendors):** don't open interactive ScreenConnect sessions to suspected compromised hosts; investigate with separate tooling. Reset ScreenConnect passwords, revoke sessions, enforce MFA and remove unknown users from a trusted device.
- **On-prem partners:** ConnectWise can't disable the extensions for you; disable the five listed extensions yourself, keep their install records and don't reinstall them.
- **Check history:** review Run Command, Toolbox and extension-install records even without alerts. BleepingComputer quotes Huntress saying sequential attacker tags suggest earlier MSP victims.
- **Not yet known:** how the attackers got in (Huntress's telemetry points to compromised credentials and hijacked support sessions) and whether the technician pivot uses a software flaw.
- IOCs and a step-by-step response are in the linked hunt and playbook.

Sources: [ConnectWise Trust Center advisory: ScreenConnect precautionary extension disabling and partner guidance (Nov 11, 2026, 22:45 UTC)](https://www.connectwise.com/company/trust/advisories) · [Huntress Support: 2026 - November - ScreenConnect (indicators and response steps)](https://support.huntress.io/hc/en-us/articles/57422935234195-2026-November-ScreenConnect) · [Huntress on X (Nov 11, 2026)](https://x.com/HuntressLabs/status/2120628394677149809) · [BleepingComputer: Active ScreenConnect attacks breach MSPs, impact dozens of organizations (Nov 11, 2026)](https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/)