Threats · 7h ago
Blackpoint Cyber found that SCKit in the ConnectWise ScreenConnect campaign contains an exploit for patched client flaw CVE-2026-84869; Huntress reports 288 compromised endpoints across 48 organizations. ConnectWise disabled five RMM+ family extensions across about 400 partner environments, while the initial access route remains under investigation.
When a technician connects to an infected endpoint, SCKit can attempt to send malware back to the technician’s workstation, then hijack authenticated sessions and use ScreenConnect’s normal management features to push code to other panels. Blackpoint says a fully patched client blocks the CVE exploit, but not this session-abuse route; ConnectWise warns that disabling extensions and resetting credentials alone may leave software or persistence already planted.
For managed service providers, technician workstations and other customer environments they can access sit inside the same incident boundary: an infected customer machine can become a route into the support operation even after the client flaw is patched.
7 sources covering this story
New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks
A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians' computers and compromise additional managed networks.
Rogue remote-access campaign spread through ScreenConnect add-on, researchers say
ConnectWise disabled five third-party extensions across 400 partner environments after attackers abused RMM+ to deploy SCKit malware on 288 computers.
The Record from Recorded Future
Abuse of an independent third-party tool led to breaches at ScreenConnect customers, confirmed the software's maker, ConnectWise.
SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths
SCKit exploits patched ScreenConnect flaw CVE-2026-84869 and attempts to hijack technician sessions to spread across managed endpoints.
Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs
ConnectWise disables third-party extensions in 400 environments as bughunters uncover auth hole may let crims bypass MFA
Hackers Deploy Malware in Fresh ScreenConnect Campaign
The attackers exploited a vulnerability in a legitimate extension to bypass ScreenConnect authentication.
ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients
Attackers abuse ScreenConnect access to deploy SCKit malware, targeting at least 288 endpoints across 48 organizations.
Attackers are using cloud-hosted ScreenConnect panels to install rogue clients on hundreds of managed endpoints.
Active ScreenConnect attacks breach MSPs, impact dozens of organizations
ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices.
Part of the PlainSec briefing for 2026-11-13