If an external IT provider manages your PCs and servers through remote-access software, read this before you do anything else today. A fast-moving attack campaign is hijacking ConnectWise ScreenConnect partner accounts — the exact kind of tool many managed service providers (MSPs) use to log into client machines — and planting malicious software inside customer environments.
What happened
On 11 November 2026 at 22:45 UTC, ConnectWise published a security advisory confirming it is aware of unauthorized access to ScreenConnect partner accounts, followed by the deployment of unauthorized remote-access software inside customer environments. The company named five third-party extensions tied to the activity — Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link — and told on-premise partners using them to disable those extensions themselves immediately. According to reporting by The Hacker News, ConnectWise has so far identified around 400 partner environments with at least one of these extensions installed.
Security firm Huntress observed the attack in real time: attackers with access to cloud-hosted ScreenConnect panels pushed "Run" commands that installed rogue ScreenConnect clients onto at least 288 managed endpoints across 48 organizations. The campaign started around 17:47 UTC on 11 November, and every single infection happened within about 90 minutes. This was not a slow, careful break-in — it was automated and fast.
Why this is worse than a normal malware infection
According to Huntress's technical analysis, the rogue clients deliver a toolkit called SCKit that does four things once it lands on a machine: it establishes persistent remote access for the attacker, adds exclusions to Microsoft Defender so its own files go unscanned, installs a second attacker-controlled remote-access client as a backup, and creates a scheduled task that replaces the legitimate ScreenConnect installation with the attacker's own copy — allowing it to intercept session cookies going forward.
That last point matters most for recovery. Resetting your MSP's ScreenConnect password does not remove this. The attacker's client is now disguised as the legitimate one, with its own persistence mechanism, sitting on the endpoint waiting.
What ConnectWise is telling partners to do
ConnectWise's advisory is explicit: do not open an interactive ScreenConnect session to a device you suspect is compromised. Doing so can hand the attacker your session, exactly the vector they are already exploiting. Instead, investigate suspected devices with separate security tooling that is not dependent on ScreenConnect itself.
What Swiss business owners should do today
- Ask your IT provider directly, today: do they use ConnectWise ScreenConnect, and if so, do they use any of the five named extensions (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, RMM+ Password Link)? If yes, those need to be disabled now, not after the weekend.
- Do not rely on a password reset alone. If your provider's account was compromised, every endpoint it touched needs to be checked for rogue clients and the SCKit toolkit — not just re-secured at the account level.
- Check for unexpected Microsoft Defender exclusions on your servers and PCs. New exclusion rules you did not create are a strong warning sign.
- Ask whether your provider is using an independent tool to check your machines, rather than logging in through the same potentially compromised ScreenConnect panel.
- If you manage remote access in-house rather than through an MSP, check your own ScreenConnect installation against the ConnectWise advisory now.
This is exactly the kind of fast-moving, supply-chain-style attack we expect to see more of: criminals going after the tools IT providers use to reach dozens of businesses at once, rather than attacking each company one by one. We will keep tracking developments like this and reporting what actually needs doing, in plain language, as they happen.
If you want a second opinion on how your business's remote access and endpoint protection is set up — whether you work with an MSP already or not — Flitz.ai's team at The Mejlerö Company offers a free network analysis and a free one-hour consultation, and can help put solid IT fundamentals and automation in place so this kind of incident is easier to catch and contain.
Switzerland.