Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs

A flaw in the third-party RMM+ plugin for ScreenConnect allowed attackers to completely bypass multi-factor authentication simply by submitting a blank access key — a critical authentication logic failure that required no sophisticated exploitation. Because RMM tools operate with broad, trusted access across managed endpoints, a single compromised plugin cascaded malware across 288 machines in 48 separate organizations. This incident illustrates how third-party extensions and plugins inherit the trust and reach of the platforms they extend, making their security posture as important as the core product's. Organizations that rely on remote monitoring and management tools must treat every plugin or extension as a potential attack surface subject to the same vetting rigor as the primary software.