SCKit worm-like malware targets MSPs in ScreenConnect attacks

BleepingComputer reports that SCKit was deployed in the recent ScreenConnect attacks against managed service providers (MSPs). The toolkit is designed to spread from infected customer devices to MSP technicians' computers and then compromise additional managed networks. It attempts to exploit CVE-2026-84869, a previously patched ScreenConnect client-side file-transfer vulnerability, but Blackpoint Cyber confirmed that the exploit failed in testing against a patched ScreenConnect client, and Huntress and Blackpoint Cyber have not observed successful exploitation during the attacks.

Huntress reported in an updated report that the attacks compromised at least 288 endpoints across 48 organizations, and believes the initial access was through RMM+, a third-party ScreenConnect extension. Versions 1.0.31 and 1.0.32 contained an authentication flaw that could allow commands to run when no access key had been configured. ConnectWise disabled five potentially related third-party extensions across approximately 400 partner environments and said their presence does not mean those environments were compromised.

According to the researchers, SCKit is a collection of 16 scripts and components that establish persistent remote access and attempt to steal ScreenConnect authentication cookies from technicians' browsers. Huntress also noted that the RelayTrap component appears to have been generated using a large language model. MSPs are urged to disable the affected extensions, update ScreenConnect clients, and review Run Command and Toolbox activity for signs of compromise.

Why it matters For MSPs, the worm-like design means a compromised customer endpoint could reach a technician's workstation and their existing ScreenConnect permissions, extending an intrusion across customer organizations. Our analysis is that the reported failure of the exploit and the absence of observed spreading reduce immediate risk, but the stolen-cookie and session-reuse techniques make reviewing extensions, Run Command activity and technician sessions a priority for investigators.