ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

AI Summary

ConnectWise's ScreenConnect platform was at the center of a campaign hitting at least 288 endpoints across 48 organizations, with attackers deploying rogue clients via a compromised third-party extension rather than a new ScreenConnect vulnerability. Blackpoint Cyber's APG linked the SCKit worm-like toolkit to CVE-2026-84869 (CVSS 9.9), a patched critical flaw, and ConnectWise disabled five third-party extensions across approximately 400 partner environments.

Read full article → https://thehackernews.com/2026/11/screenconnect-at…

Relevance score: 81.0/100

# More from November 13

1
Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2 The Hacker News
2
New N-able "4EverAble2Shell" zero-day exploited hours after PoC released BleepingComputer
3
US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance CyberScoop
4
Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely The Hacker News
5
International operation dismantles malware networks, exposes 6.4 million stolen credentials CyberScoop
7
Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass The Hacker News
8
New Windows SignDrop zero-day gives hackers SYSTEM privileges BleepingComputer
9
Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories The Hacker News
10
AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets The Hacker News