Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs
ConnectWise disables third-party extensions in 400 environments as bughunters uncover auth hole may let crims bypass MFA
A security company warned of an ongoing malware campaign targeting cloud-hosted ScreenConnect instances, with at least 288 machines compromised across 48 organizations. The attacks, which begin with unauthorized access to third-party extensions, install a 16-file malware toolkit called SCKit. This toolkit establishes persistent remote access even if the legitimate connection is shut down, and contains code to spread the infection to IT technicians and potentially other customers.
The malware is designed to turn infected computers into traps for technicians, stealing authentication cookies and using them to infect additional machines. ConnectWise, which acquired ScreenConnect in February 2015, has disabled several extensions but has not confirmed how the attackers gained initial access. Administrators are advised not to investigate suspected infections remotely, as this could put their own machines at risk.
Both Huntress and ConnectWise urge administrators to use other security tools to investigate affected machines and remove any residual malware before bringing them back online.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
