Rogue ScreenConnect tools put MSP trust paths under pressure
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Friday, November 13th, 2026.
Attackers used cloud-hosted ScreenConnect environments to install rogue remote-access clients on at least 288 endpoints across 48 organizations. All identified systems were targeted within about 90 minutes. Researchers traced likely initial access to versions of the R M M+ extension that could accept a blank shared key.
The campaign also deployed a toolkit designed to spread from infected customer devices to MSP technicians. It attempted to steal technician session cookies and use legitimate management permissions to reach additional endpoints. However, researchers found no successful exploitation against patched clients.
Remote-support platforms create trusted paths between providers, technicians and customer systems. For leaders, this incident shows that third-party extensions can expand risk even when the core platform is not compromised. For defenders, the priorities are to disable affected extensions, update clients and review command, toolbox and unauthorized client activity. Management trust can accelerate legitimate support, but it can also accelerate malicious spread.
Disable vulnerable extensions and investigate every unauthorized remote-access client as a possible persistence mechanism.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
