SCKit hit 288 ScreenConnect endpoints; researchers disagree on the flaw

On 11 November 2026, a threat actor gained unauthorized access to cloud-hosted ScreenConnect instances belonging to managed service providers. Huntress, which first flagged the burst that day, said remote commands from those panels installed attacker-run clients on at least 288 computers across 48 organizations. The activity started near 17:47 UTC; about one third of the machines were reached inside 10 minutes and the rest within about 90 minutes. At the first warning, Huntress was tracking six compromised providers and more than 286 endpoints, with the tally still rising, and it suspects further providers because the victims appeared to be numbered in order.

ScreenConnect, formerly ConnectWise Control, is the remote-support platform many providers use to administer customer devices, often beside RMM software, so a captured console can lead to technicians and other customers. ConnectWise has already turned off five independently developed extensions in roughly 400 partner environments wherever it could act. Its advisory said it found no evidence of a compromise of its infrastructure or of a bug in ScreenConnect itself. Its initial assessment suggests the activity may involve a threat actor abusing separate third-party extensions present in partner setups.

Huntress traced the commands to RMM+, one extension that was disabled. RMM+ lets other tools drive sessions without someone working in the console, and it checks a shared access key rather than ScreenConnect accounts, roles, and MFA. In releases 1.0.31 and 1.0.32, Huntress said, an unset key came up empty and the check allowed that empty value. The pattern matched the intrusion: orders arrived across several installs, including ScreenConnect 26.6.6.9747 and 26.7.6.9783, with no login alongside them. Most copies Huntress reviewed looked like genuine add-ons left in place after a project. The Hacker News, citing Blackpoint Cyber's Adversary Pursuit Group, described an ongoing campaign that exploits already-patched CVE-2026-84869 (CVSS 9.9) and is not a new vulnerability; Blackpoint said the recovered toolkit uses that bug. Huntress has tracked similar worm-like behavior since September, when ConnectWise shipped an update for the same file-transfer issue. For this November wave, Huntress and ConnectWise both pointed to an abused third-party add-on. Microsoft Threat Intelligence says it confirmed what ConnectWise reported and has seen ScreenConnect used to plant unauthorized clients and the SCKit worm.

Microsoft says deployment begins with commands that silently install a lookalike client tied to infrastructure the attackers control. A batch launcher then retrieves a PowerShell decoder that decrypts SCKit with key material specific to the device. Huntress describes SCKit as a 16-file kit that halts the genuine client, puts the intruder's copy in its place, and reuses the real client's libraries so the host still looks ordinary. The toolkit persists with scheduled tasks and registry Run entries, and it deploys RelayTrap to hand a payload to a technician who connects. Other code is built to steal a session cookie and replay it toward further customers; Huntress said those attempts failed in every host log recovered and checked so far. The worm is aimed at technician workstations via the hijacked authenticated session, then at more managed devices through that person's console. The resulting foothold can administer endpoints, run commands, and drop more tools apart from the legitimate support instance.

Microsoft says defenders should examine the workstations technicians use and endpoints affected further along the chain. Deleting only the extra client leaves SCKit's persistence behind and does not cancel web sessions already exposed. Its blog includes mitigation guidance, indicators of compromise, and Microsoft Defender XDR advanced hunting queries.