ConnectWise disables third-party extensions in 400 environments as bughunters uncover auth hole may let crims bypass MFA

SCKit abuses ScreenConnect to deploy unauthorized remote access and target technicians. Explore the attack chain, mitigations, and Microsoft Defender XDR hunting.

SCKit abuses ScreenConnect to deploy unauthorized remote access and target technicians. Explore the attack chain, mitigations, and Microsoft Defender XDR hunting.

ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices. [...]

Lawrence Abrams reports: ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices. As part of its investigation, ConnectWise has disabled five third-party ScreenConnect extensions across approximately 400 partner environments as a precaution, warning that they may be associated with...

A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians' computers and compromise additional managed networks.

Explore this post and more from the msp community

Attackers use Crypto Exchange Names to Disguise Unauthorized Sessions on 100+ ScreenConnect Servers BackgroundOn November 12, 2026, an MSP asked us about a handful of unfamiliar machines in their self-hosted ScreenConnect console. Named after various crypto exchanges, the machines had no apparent co ... Read more Published Date: Nov 14, 2026 (2 hours, 25 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-84869

Abuse of an independent third-party tool led to breaches at ScreenConnect customers, confirmed the software's maker, ConnectWise. Cybersecurity researchers had spotted intrusions at nearly 50.

Attackers have taken over cloud-hosted ScreenConnect panels and used them to push a custom toolkit called SCKit to at least 288 managed devices across 48 organizations. Security firm Huntress first saw the activity on November 11, 2026, and says all 288 hosts were hit within about 90 minutes. Huntress reports that about one third of them were hit in the first 10 minutes. The attacker used the Run command feature in the ScreenConnect panel to send commands to many endpoints at once. These commands ran with SYSTEM rights, which is the highest level on Windows. The command first checked for an existing ScreenConnect client. It then downloaded a rogue installer to C:\Windows\TEMP\sc.msi and installed it silently. Huntress says it is working with ConnectWise on the case. Reports say the latest ScreenConnect versions, 26.6.6.9747 and 26.7.6.9783, are affected. ConnectWise says it has found no sign that its own systems were broken into and no flaw in ScreenConnect itself. ConnectWise ScreenConnect Hijacked In a public advisory posted on November 11, ConnectWise named five outside extensions that may be tied to the activity. These are Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. The company turned them off in about 400 partner environments as a safety step. ConnectWise says these extensions offer an API that can run remote commands, and a passphrase set by the partner protects that API. Having an extension installed does not prove a break-in. The company has not yet found the first point of entry or the full scope. Partners who run servers on their own premises must turn the extensions off themselves, because ConnectWise cannot do it for them. SCKit is a package of 16 files, including PowerShell scripts, batch files, and settings data. The infected machine sends its Windows ID to the attacker’s server. The server replies with the key needed to unlock a payload made for that one machine. This makes file hashes a weak way to spot the threat. Next, the scripts install a second rogue ScreenConnect client and add exclusions to Microsoft Defender. They also create a tool called RelayTrap in C:\ProgramData\RelayTrap . A scheduled task named TrapWatch stops the real ScreenConnect client and puts the attacker’s copy in its place. The machine still looks normal to the admin. Huntress also noted that the C# code for RelayTrap looks like it was written with an AI model. The toolkit has a second goal. Huntress found code built to wait until a technician connects to an infected device. It then pulls a dropper onto the technician’s workstation and steals the .aspxauth session cookie. With that cookie, the code tries to reach every other session the technician can open, and it uploads a payload to the panel’s Shared Toolbox. Huntress has not seen this spread work. The console takeover failed in every host log it has checked so far. Still, the design shows why defenders should be careful. This is not the first time criminals have turned ScreenConnect against its users. In September, Cyber Security News covered worm-like rogue ScreenConnect clients that passed staged scripts between Windows machines. Around the same time, CISA added CVE-2026-84869 to its Known Exploited Vulnerabilities list. That flaw allows file transfers during a live session without the host’s approval. Huntress says ConnectWise later fixed it, and it scored 9.9 on the CVSS scale. Huntress and ConnectWise give the same core advice. Do not connect to a suspect machine through ScreenConnect, because that session can carry the malware to your own workstation. Use EDR live response, WinRM, or another tool outside ScreenConnect. Teams should also: Isolate affected hosts until cleanup is finished. Huntress saw some machines reinfect after isolation was lifted. Remove the rogue client, the TrapWatch task, the RelayTrap folder, and the RelayTrapLiteAlert Run key. Check Run Command and Toolbox history for jobs nobody started. Revoke active web sessions and rotate credentials from a clean device. Indicators include the domains newnewnew.gotdns[.]org , soxnewwork.homedns[.]org , cdn007-digitaldownloads[.]com , and ns.mo7sen[.]dev . They also include the IP address 185.99.255[.]28 and the participant name Addmin . ConnectWise says the investigation is still open and it will update its advisory as facts are confirmed. Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Hackers Hijack ConnectWise ScreenConnect to Deploy SCKit Malware Across 288 Devices at 48 Organizations appeared first on Cyber Security News .

Huntress says an attacker used several cloud-hosted ScreenConnect panels on November 11 to push rogue clients and a toolkit called SCKit to at least 288 machines at 48 organizations.

ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access. In an advisory posted on its site, the company said there is no evidence that the incident involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software. "Our initial assessment suggests the activity may involve

ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer de...

A worm-like toolkit named SCKit was used in ScreenConnect attacks on MSPs. How it spreads to technicians and what to review in your remote access.

Huntress reports that attackers abused ScreenConnect access and a likely RMM+ authentication flaw to compromise 288 hosts across 48 organizations…

ConnectWise disabled five third-party extensions across 400 partner environments after attackers abused RMM+ to deploy SCKit malware on 288 computers.

The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged. Blackpoint Cyber's Adversary Pursuit Group (APG), which shared the details with The Hacker News, said the recovered attacker toolkit exploits CVE-2026-84869 (CVSS score: 9.9), an

A Dangerous RMM Security Incident Exposes 48 Organizations A new cybersecurity campaign targeting managed service providers (MSPs) has exposed serious security weaknesses in ConnectWise ScreenConnect, with attackers deploying a sophisticated malicious toolkit called SCKit across at least 288 endpoints belonging to 48 organizations. The campaign, detected by cybersecurity firm Huntress on November 11, 2026, exploited compromised cloud-hosted ScreenConnect management panels to execute malicious commands, install unauthorized remote-access clients, and establish persistent access to infected systems.