ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

Threat actors exploited compromised credentials or hijacked sessions to gain access to ScreenConnect administrative panels, then leveraged rogue third-party extensions to push malicious clients to at least 288 endpoints across 48 organizations. The root issue is not a vulnerability in ScreenConnect itself, but rather weak access controls around the administrative interface and insufficient vetting of third-party extensions. This matters because remote management tools are high-value targets — control over the management plane means control over every endpoint it manages. Organizations that treat RMM tools as inherently trusted without layering additional access controls are exposed to cascading compromise at scale.