Rogue remote-access campaign spread through ScreenConnect add-on, researchers say

Attackers exploited a third-party ScreenConnect extension (RMM+) to bypass authentication and spread rogue remote-management software to nearly 300 systems across 48 organizations — without compromising ConnectWise's core infrastructure. This highlights a critical blind spot: organizations often scrutinize the primary vendor but neglect the security posture of third-party plugins and extensions that plug into trusted platforms. Because these add-ons inherit the trust and access of the host platform, a vulnerable or malicious extension can effectively become an open door into managed endpoints. The incident demonstrates that supply chain risk extends beyond software vendors to any third-party component integrated into an operational toolchain.