AI Summary

Hackers exploited a vulnerability in a legitimate extension to bypass authentication on ConnectWise ScreenConnect, compromising hundreds of endpoints across dozens of customers, according to Huntress. The campaign was observed on November 11, when attackers used unauthorized access to cloud‑hosted ScreenConnect panels to run commands on managed devices, affecting at least six MSPs, 288 hosts and 48 organizations. Within 90 minutes all compromised hosts were hit, deploying rogue ScreenConnect clients and the SCKit toolkit, which provides persistent backdoor access, intercepts session cookies, self‑replicates, and spreads by infecting technicians’ workstations and other sessions.

AI summaries can be wrong sometimes—always verify important details using the source article.