ScreenConnect malware spreads through technicians’ support sessions
Blackpoint Cyber found that SCKit in the ConnectWise ScreenConnect campaign contains an exploit for patched client flaw CVE-2026-84869; Huntress reports 288 compromised endpoints across 48 organizations. ConnectWise disabled five RMM+ family extensions across about 400 partner environments, while the initial access route remains under investigation.
When a technician connects to an infected endpoint, SCKit can attempt to send malware back to the technician’s workstation, then hijack authenticated sessions and use ScreenConnect’s normal management features to push code to other panels. Blackpoint says a fully patched client blocks the CVE exploit, but not this session-abuse route; ConnectWise warns that disabling extensions and resetting credentials alone may leave software or persistence already planted.
For managed service providers, technician workstations and other customer environments they can access sit inside the same incident boundary: an infected customer machine can become a route into the support operation even after the client flaw is patched.
New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks
A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians' computers and compromise additional managed networks.