SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths Ravie LakshmananNov 12, 2026Vulnerability /Malware The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged. Blackpoint Cyber's Adversary Pursuit Group (APG), which shared the details with The Hacker News, said the recovered attacker toolkit exploits CVE-2026-84869 (CVSS score: 9.9), an improper privilege management and missing authorization vulnerability that could allow an attacker to file transfer and execute through an active remote session without authorization or host confirmation. The cybersecurity company confirmed that testing against a fully patched ScreenConnect client successfully prevents execution of the exploit's payload. "Our testing confirmed that the exploit targets CVE-2026-84869 and that the existing patch successfully blocks it," APG researchers Sam Decker and Nevan Beal said. "That's an important finding for security teams." "But the toolkit also includes capabilities to hijack authenticated operator sessions and use legitimate ScreenConnect management features to push malicious code. Patching addresses the known exploit, but it doesn't eliminate the risks associated with a compromised operator session." Notably, the SCKit malware contains functionality called RelayTrap to reverse-pivot to infect the workstations of technicians who attempt to investigate suspicious activity in a managed endpoint. In other words, the activity abuses trusted functionality and does not rely on a software vulnerability once an attacker obtains a valid session. The attack sequence makes use of the platform's built-in Run Command functionality to execute commands. This involves first checking for an existing ScreenConnect installation before downloading and running an attacker-controlled MSI installer ("sc.msi"), which then delivers the batch script dropper ("sckit-run.bat"). The batch script dropper subsequently contacts "ns.mo7sen[.]dev" to fetch a PowerShell decoder ("sckit-decoder.ps1") and ultimately deploy various components associated with the SCKit toolkit. This includes a PowerShell script ("SilentForceInstall-WithUninstall.ps1") used to establish persistent remote access by deploying two unauthorized ScreenConnect Access clients, along with a set of scripts and C# code designed to interfere with existing ScreenConnect Guest sessions, including RelayTrap. The component attempts a guest-to-host file execution technique associated with CVE-2026-84869 by replacing the legitimate ScreenConnect Guest and sending the SCKit payload back toward the connecting technician for execution. If this action is successful, the malware tries to recover the technician's authenticated ScreenConnect browser sessions and leverage their existing management permissions to distribute commands across additional endpoints they have access to. As a result, an attacker can move beyond the original compromised system and into other customer environments through the same infrastructure used to administer them. "Because these commands were executed through existing ScreenConnect agents, the attackers could deploy additional software under the NT AUTHORITY\SYSTEM context without needing to establish a separate execution method on each machine," Blackpoint Cyber said. "The unauthorized Access clients provide attackers with persistent control over the endpoint, while the RelayTrap components position the malware to intercept legitimate support connections. Rather than simply preventing administrators from accessing an infected machine, the toolkit attempts to use their next connection as an opportunity to extend the intrusion directly to the technician's workstation." The end goal of the attack appears to target technicians, as they regularly connect to managed endpoints belonging to different customers, typically from workstations with access to administrative tools and authenticated management sessions. This enables the attackers to break out of the original endpoint and move the intrusion into an environment with potentially broader access and privileges. Once the malware gets executed on the technician's machine, it shifts from remote support manipulation to session theft, searching the local browser data and process memory of the machine to recover an existing authenticated management session (i.e., .ASPXAUTH cookies) that can be used to propagate the malware to other endpoints without having to obtain their credentials. "By first attempting to compromise a technician's workstation, then recover their authenticated ScreenConnect session, SCKit seeks to turn access to a single managed endpoint into an opportunity to reach other systems under that technician's control," the researchers said. The Hacker News has contacted ConnectWise for comment, and we will update the story if we hear back. It's worth noting that CVE-2026-84869 was previously exploited in a set of attacks in which threat actors leveraged ScreenConnect to distribute a malicious four-stage Visual Basic Script (VBScript) payload to newly connected systems and ultimately serve an XMRig cryptocurrency miner. The vulnerability was added by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to its Known Exploited Vulnerabilities (KEV) catalog on September 11, 2026, requiring federal agencies to apply the fixes by September 14, 2026. In response to the latest incident, ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments. However, Blackpoint Cyber said it found no technical link between those extensions and SCKit. As of writing, there is no evidence that the activity has established successful propagation to a technician workstation or bypassed the vendor patch for CVE-2026-84869. The findings reinforce the importance of patching ScreenConnect clients, and underscore the need for stronger operator-session protections, including tighter session validation and additional authentication for bulk administrative actions, Blackpoint Cyber noted. "Organizations need to protect those sessions and put additional safeguards around high-impact administrative actions," the researchers said. "For MSPs, the practical lesson is to investigate the management relationship, not only the endpoint. Rogue Access installations, administrative command history, technician workstations, and browser sessions all deserve attention, especially when support personnel have already connected to a suspected system." Huntress, in an update, said it has identified a serious authentication flaw in versions 1.0.31 and 1.0.32 of RMM+, one of the five third-party ScreenConnect extensions that has already been blocked by ConnectWise. "When an administrator had not configured an access key, the extension would accept a blank one, potentially allowing unauthorized commands to execute without going through ScreenConnect's normal authentication controls," the company said in a statement shared with The Hacker News. RMM+ makes it possible for another tool to manage ScreenConnect sessions without a technician working through the console. It authenticates requests with a shared access key ("RMMPlus.AccessKey") stored in the extension's settings. However, in versions 1.0.31 and 1.0.32, the key defaults to a blank value. Because RMM+ operates independently of ScreenConnect's normal user accounts, roles, and authentication controls, an attacker could potentially execute commands on the device without bypassing multi-factor authentication. "Commands reached endpoints across several ScreenConnect instances within minutes. There was no corresponding login activity and the commands appeared in the logs reviewed linked to RMM+." It's worth mentioning here that while the toolkit possesses capabilities to exploit CVE-2026-84869, there is no evidence to suggest that an unpatched ScreenConnect client was the initial entry point for the attack. "At this time, initial access appears to be linked to malicious ScreenConnect extensions, although we do not have sufficient evidence to confirm this," Beal, principal MDR analyst at Blackpoint, told The Hacker News. "Identifying patient zero would require additional forensic evidence from affected environments. Similarly, while November 11 marks the earliest publicly reported activity, we cannot rule out earlier compromises without further investigation. Our findings confirm the toolkit's capabilities but do not establish when or how the initial compromise occurred." When contacted for comment, a ConnectWise spokesperson told The Hacker news that it's aware of reports of malicious activity affecting a limited number of ScreenConnect partners and that it's actively investigating the incident. "While the initial access method remains unconfirmed, our initial assessment suggests the activity may involve a threat actor's abuse of independent third-party extensions installed in partner environments," the spokesperson said. "We have disabled the identified extensions where we can take action as a precaution and are advising on-premises partners to disable them immediately. The presence of these extensions alone does not establish compromise. We encourage partners to review the precautionary guidance in the ConnectWise Trust Center, where we will provide updates as information is validated." (The story was updated after publication to include responses and insights from ConnectWise, Blackpoint Cyber, and Huntress.) Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cyber Attack, Malware, Remote Access Security, Vulnerability Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content The Flood is Coming And The Pipes Were Already Full Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Attend Live Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The 2026 Identity Crisis: Why Your IAM is Only Half the Story Stop driving blind. See the identity blind spots traditional IAM misses. Watch now. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk