A worm-like toolkit called SCKit has turned a trusted remote support tool into an attack path against managed service providers. Attackers used access to cloud-hosted ConnectWise ScreenConnect panels to push commands that installed rogue ScreenConnect clients on customer machines, giving them a separate channel that could survive the legitimate session being closed.
Security firm Huntress said the activity began on November 11, 2026, at around 17:47 UTC, and that at least 288 endpoints across 48 organizations were hit within 90 minutes. About a third were affected within the first 10 minutes, and Huntress stressed that its count covers only its own customers.
The suspected entry point was not ScreenConnect itself. Huntress believes the initial access came through RMM+, a third-party extension that lets external tools interact with ScreenConnect sessions without the standard technician console. Versions 1.0.31 and 1.0.32 contained an authentication flaw: RMM+ uses a shared access key instead of normal accounts and multifactor authentication, and when an administrator had never configured a key, the vulnerable versions accepted an empty one. That would let an attacker issue commands with no user login in the logs.
ConnectWise said it has found no evidence of a compromise of its own infrastructure or of a vulnerability in ScreenConnect itself, and that the entry method remains under investigation. As a precaution it disabled five third-party extensions in about 400 partner environments: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. It emphasized that 400 counts environments where at least one extension was installed, not confirmed compromises. In a November 13 update it warned of additional activity against on-premises environments where the extensions remain enabled, and told those partners to disable them immediately.
Once installed, SCKit worked to stay in place. Microsoft Threat Intelligence, which confirmed the campaign on November 13, said deployment starts with commands issued through ScreenConnect to silently install an identical client connected to attacker-controlled infrastructure. A batch launcher then retrieves a PowerShell decoder that decrypts and extracts the toolkit using device-specific key material. The toolkit establishes persistence through scheduled tasks and registry Run entries, in a collection of 16 scripts and components.
The most novel part is RelayTrap, a component designed to reverse the normal direction of a support session. It replaces the legitimate ScreenConnect guest process on an infected endpoint and waits for a technician to connect. It then attempts to send a malicious file back to the technician workstation by exploiting CVE-2026-84869, a client-side file-transfer flaw that ConnectWise patched in client version 26.6.5 on September 8, 2026. Other components try to steal ScreenConnect authentication cookies from browsers, which could let attackers hijack a technician session and use its permissions to reach still more endpoints.
That worm-like spread, however, has not been seen succeeding. Huntress said the console takeover attempt failed in every recovered host log it examined, and Blackpoint Cyber researchers told BleepingComputer that the exploit failed in testing against a patched client: the guest queued the transfer, but the current client never requested or ran the payload. ConnectWise likewise said the 26.6.5 fix blocks the attempted endpoint-to-technician technique, and warned that updating a cloud console does not automatically update technician clients.
For MSPs and their customers, the immediate work is concrete. Disable the listed extensions, verify every technician client is on version 26.6.5 or later, hunt for unauthorized ScreenConnect installations, and review Run Command and Shared Toolbox activity. Microsoft added that removing an unauthorized client alone does not remove SCKit persistence or invalidate exposed web sessions, so technician workstations and downstream endpoints both need investigation before they are trusted again.