Huntress said on Wednesday that attackers are abusing cloud-hosted ScreenConnect. IT firms called MSPs use it to manage customers' computers remotely. Huntress counts six breached MSPs and at least 286 devices, both still rising. BleepingComputer reported that the devices span 47 organizations. Attackers use the Run Command feature to push extra ScreenConnect clients onto managed devices. That gives them access outside the MSP's own setup. ConnectWise, the maker, is investigating.
Huntress has not found how attackers got into MSP systems. Its data points to stolen logins and hijacked support sessions. It also warned that a technician's computer may be compromised when the technician connects to an infected customer device. How that works is unclear, including whether it uses a software flaw. BleepingComputer found a July 2026 script, styled as a Social Security statement, that looks for one of the same rogue client IDs. Whether the two are linked is unknown.
An MSP's remote tool is a single point of trust: whoever controls it can reach every customer it serves. Run Command is a normal feature, so misuse can resemble routine admin work. Customers can ask their MSP whether it reviews Run Command history and keeps technician computers apart from customer sessions. ConnectWise tells partners to avoid live sessions with suspect devices. It also urges them to revoke sessions, change logins on a clean device and check multifactor authentication.