# RMM+ flaw enabled malware attacks on 288 computers across 48 organisations

- URL: https://talkfuse.com/story/hackers-exploiting-screenconnect-plugin-flaw-to-spread-malware-across-hundreds-of-pcs/
- Published: 2026-11-12T13:02:00+00:00
- Updated: 2026-11-12T13:37:17+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/11/12/hackers-exploiting-screenconnect-plugin-flaw-to-spread-malware-across-hundreds-of-pcs/5309361
- Topics: Cybersecurity, Environment, Science, Technology

## Key points

- A suspected RMM+ flaw enabled attacks on 288 computers at 48 organisations.
- ConnectWise disabled five related extensions across some customer environments.
- The malware’s attempt to spread via technicians has not been observed succeeding.

## Summary

Hackers exploited a suspected flaw in the RMM+ extension for ScreenConnect to install malware on at least 288 computers across 48 organisations. The incident matters because the extension may have allowed attackers to issue remote commands without using ScreenConnect’s normal login controls or bypassing multi-factor authentication.

Huntress says all 288 machines were hit within 90 minutes, with about a third infected in the first ten minutes. The malware toolkit can install a separate ScreenConnect client and is designed to spread to IT technicians and their other customers, although Huntress has not seen that method succeed. ConnectWise disabled five related extensions in environments where it could, identifying about 400 installations with at least one of them; the company said this did not mean those environments were compromised and reported no evidence of a breach of its own infrastructure or a flaw in ScreenConnect itself.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.