# ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

Source: [The Hacker News](https://thehackernews.com/2026/11/screenconnect-attacks-target-at-least.html) · 2026-11-12 · Security
Page: https://themorning.dev/story/screenconnect-attacks-target-at-least-288-endpoints-across-48-organizations-with-f1a5b4bff7b509d2
Kind: security · Impact: high

## In brief

- ConnectWise is investigating an active malware campaign that abuses compromised ScreenConnect environments of managed service providers (MSPs).
- The attackers use these environments to deploy rogue remote-access clients to customer devices; The Hacker News reports at least 288 endpoints across 48 organizations.
- As a precaution, ConnectWise disabled five third-party extensions in partner environments.

## Why it matters

Remote-access tools that MSPs use to manage customers can become a route into every customer device they support, so one compromised MSP can affect many organizations.

## Timeline

- 2026-11-11: ConnectWise investigates an active malware campaign targeting MSPs via compromised ScreenConnect environments
- 2026-11-12: ConnectWise disables five third-party extensions in partner environments after reports of unauthorized access

## Coverage

- [ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients](https://thehackernews.com/2026/11/screenconnect-attacks-target-at-least.html) — The Hacker News, 2026-11-12
- [Active ScreenConnect attacks breach MSPs, impact dozens of organizations](https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/) — BleepingComputer, 2026-11-11

Tags: screenconnect, msp, malware, supply-chain, remote-access, connectwise

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev