ConnectWise disables five extensions after unauthorized access reports

Image: Primary

Published Thursday, November 12, 2026 · 1:06 AM EST

ConnectWise has disabled five third-party extensions in partner environments following reports of unauthorized access. Huntress said attackers used cloud-hosted ScreenConnect panels to deploy rogue remote-access clients on at least 288 managed endpoints across 48 organizations. The extensions expose an API for remote commands protected by a partner-configured passphrase. ConnectWise identified about 400 partner environments with at least one extension installed, while stressing that installation alone does not establish compromise. It urged on-premises partners to disable the extensions. Huntress said the malicious toolkit can steal sessions and attempt further spread, but it has not observed a successful jump from an infected endpoint to a technician's workstation. Initial access remains under investigation; ConnectWise says it has no evidence of compromised company infrastructure or a ScreenConnect vulnerability.

Sources

The Hacker News

Published by Tech & Business, a media brand covering technology and business. This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

Capital AI

Nebuly raises $21m to expand AI return measurement business

Turin-based Nebuly has raised $21m in a Series A round led by Planven to expand its business measuring financial returns from enterprise AI.

AI Science

MIT technique improves climate AI predictions with less training data

MIT researchers developed a training method that helped AI climate models predict unfamiliar emissions scenarios using less data, MIT News reported.

Security

Baker Tilly notifies clients of breach affecting third-party platform

Baker Tilly Advisory Group is notifying clients that an attacker obtained client data from a third-party service platform.

Security

Maersk confirms data theft from acquired company's system

Maersk confirmed that an attacker breached a system belonging to a company it previously acquired and stole data, BleepingComputer reported. WhiteArmor claimed responsibility and demanded $5 million, alleging it holds approximately 100 GB from the OCF/LF Logistics platform.

Security Infrastructure

AWS adds individual workload security rules to EKS Auto Mode

AWS says EKS Auto Mode now lets customers apply separate network security rules to individual Pods, the units that run application workloads in Kubernetes. Applications sharing a computing node can use different security groups without requiring separate node pools.

Security

ScreenConnect campaign compromises six MSPs and reaches 47 organizations

Attackers have compromised six managed service providers and affected 286 endpoints across 47 organizations through ScreenConnect environments, cybersecurity firm Huntress reported Wednesday.