Hackers have used a dodgy third-party ScreenConnect extension to push malware onto at least 288 machines across 48 organizations, prompting ConnectWise to disable a handful of plugins in hundreds of customer environments. Security outfit Huntress first raised the alarm in a Reddit post on Wednesday, warning of an active campaign targeting cloud-hosted ScreenConnect instances. At the time, its security operations center was tracking six compromised managed service providers (MSPs) and more than 286 affected endpoints, with the numbers still climbing. ConnectWise acquired popular remote supporttool ScreenConnect in February, 2015. Huntress spotted the attacks at around 1747 UTC, when someone began using ScreenConnect’s remote command feature to install rogue clients on machines managed by multiple IT service providers. All 288 endpoints were hit within 90 minutes, with roughly a third compromised in the first ten minutes. Huntress suspects more MSPs may have been compromised, as the attackers appeared to be numbering their victims sequentially, with the numbers suggesting earlier attacks that it hadn’t detected. The attackers deployed a 16-file malware toolkit dubbed SCKit, which installs a separate ScreenConnect client to maintain remote access even if the legitimate connection is shut down. It also contains code designed to spread the infection to IT technicians and potentially other customers under their control. Huntress has since traced the activity to a possible authentication weakness in RMM+, a third-party extension that lets other management tools issue commands through ScreenConnect without technicians using its console. Versions 1. 0. 31 and 1. 0. 32 of the extension contain a flaw that means installations without a configured access key will accept a blank one. Because RMM+ operates independently of ScreenConnect’s normal user accounts and authentication controls, an attacker could potentially execute commands without defeating MFA. Huntress said the findings matched what its investigators saw during the attacks, with commands reaching machines across several ScreenConnect installations despite no corresponding login activity. The researchers also confirmed that the attacks affected ScreenConnect versions 26. 6. 6. 9747 and 26. 7. 6. 9783, meaning administrators running the latest releases weren’t necessarily safe. ConnectWise has acknowledged that third-party extensions may have been involved but has stopped short of confirming how the attackers initially gained access…