Attackers Exploit ScreenConnect Plugin Flaw to Spread Malware Across Hundreds of PCs

ConnectWise has disabled third-party extensions in about 400 ScreenConnect environments after attackers began exploiting a flaw in the plugin system to distribute malware. Security researchers also found an authentication weakness that may let attackers bypass multi-factor authentication. The incident points to remote management tools as a high-value target for attackers.

Why it matters: IT operations teams that rely on ScreenConnect for remote support should audit installed plugins, review access logs, and confirm MFA enforcement now.