On November 12, 2026, an MSP asked us about a handful of unfamiliar machines in their self-hosted ScreenConnect console. Named after various crypto exchanges, the machines had no apparent company or owner and claimed to be online. Nobody at the MSP had installed them.

The MSP’s server itself was clean. We found no evidence of web shells, suspicious child processes, or new accounts. The sessions were real entries in the server’s database, though, so we turned the question around: If one server had these guests, how many others did?

We collected the ScreenConnect session database (App_Data\Session.db) from the Huntress-protected ScreenConnect servers we could reach and looked for the same pattern. As of this writing, we’ve found 2,223 fake…