# ScreenConnect campaign compromises six MSPs and reaches 47 organizations

_Published Wednesday, November 11, 2026 at 7:09 PM EST · Security · Latest · Tier 1 — Major_

![ScreenConnect campaign compromises six MSPs and reaches 47 organizations — Primary](https://www.bleepstatic.com/content/hl-images/2026/09/16/ScreenConnect.jpg)

Attackers have compromised six managed service providers and affected 286 endpoints across 47 organizations through ScreenConnect environments, cybersecurity firm Huntress reported Wednesday. ConnectWise confirmed it is investigating and urged partners to avoid interactive remote sessions with suspected compromised devices.

Attackers use ScreenConnect's Run Command feature to install rogue clients that provide access outside the legitimate provider's environment. Huntress also warned that connecting to an infected customer device could compromise a technician's workstation. Initial access remains undetermined, although its telemetry points to compromised credentials and hijacked support sessions.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/)

---
Canonical: https://techandbusiness.org/newswire/z91qT3tSUApCtAmARrqI9G
Published: 2026-11-12T00:09:18.784Z
Story chronology: 2026-11-11T17:47:00.000Z
Retrieved: 2026-11-12T01:52:31.400Z
Publisher: Tech & Business (techandbusiness.org)