Threats · 9h ago
Huntress found 2,223 unauthorized sessions named after crypto exchanges across 118 ConnectWise ScreenConnect servers tied to 109 MSP and organization accounts. The entries were added over 10 days, from November 3 to 13, 2026. The first server Huntress examined showed no evidence of compromise, including web shells, suspicious child processes or new accounts.
ScreenConnect’s unattended-access list shows customer computers that remain registered and online. These entries appeared as ordinary machines, with exchange-themed names and trading-screen thumbnails, but the MSP had not installed them. A technician could mistake one for a legitimate customer endpoint and interact with it; Huntress did not report that technicians did so.
For MSPs, a clean server-compromise investigation does not by itself account for unauthorized entries in the console. If technicians rely on these lists to choose machines for remote support, the exposure is trust placed in an endpoint with no known owner; similar consoles may pose the same risk when unverified devices appear as customer systems.
1 source covering this story
Fake crypto exchange sessions are showing up on ScreenConnect servers and could be bait for technicians.
Part of the PlainSec briefing for 2026-11-13