SCKit attacks target MSPs through ScreenConnect customer sessions
Managed service providers face a cross-customer compromise risk in recent ScreenConnect attacks. BleepingComputer reported that attackers installed rogue ScreenConnect Access clients on customer endpoints and deployed SCKit, a toolkit designed to spread from an infected customer device to an MSP technician's computer and then to other managed networks.
Huntress said the campaign compromised at least 288 endpoints across 48 organizations. The affected devices were targeted within 90 minutes, and about one-third were reached during the first 10 minutes, according to the report cited by BleepingComputer.
Huntress believes the attackers initially used the RMM+ ScreenConnect extension. Versions 1.0.31 and 1.0.32 had an authentication flaw that could accept a blank shared access key when an administrator had not configured one. That could let an attacker issue remote commands without authenticating to ScreenConnect or completing multifactor authentication, while the observed commands were linked to RMM+ rather than normal user logins.
The SCKit toolkit also attempted to infect the technician handling a compromised endpoint. Huntress and Blackpoint Cyber described RelayTrap, which replaces the legitimate ScreenConnect Guest process and waits for an interactive support session. It then tries to send a file from the customer endpoint to the technician's workstation by exploiting CVE-2026-84869, a client-side file-transfer vulnerability that ConnectWise fixed in ScreenConnect version 26.6.5.
The researchers have not seen that propagation succeed in this campaign. Blackpoint said testing against a patched ScreenConnect client showed that the transfer was queued but the client did not request or run the payload. Huntress also reported that console takeover attempts failed in every recovered host log it examined.
SCKit nevertheless tries to steal ScreenConnect authentication cookies from browsers on a technician's workstation. The attackers could then use the technician's existing ScreenConnect permissions and legitimate features such as Shared Toolbox to enumerate accessible endpoints and distribute commands, according to the two research teams.
ConnectWise disabled five potentially related third-party extensions across about 400 partner environments, while stressing that their presence alone did not prove compromise. Huntress and Blackpoint recommend disabling the affected extensions, updating ScreenConnect clients, checking for unauthorized remote-access installations and reviewing Run Command and Toolbox activity. They also advise against opening interactive ScreenConnect sessions with potentially infected endpoints during an investigation.