-
Active ScreenConnect abuse: Since November 11, 2026, attackers have accessed MSP cloud instances and used them to deploy unauthorized remote-access clients and SCKit.
-
SCKit persists and spreads: The toolkit installs hidden clients, scheduled tasks, and registry entries, then uses RelayTrap to target technicians connecting from vulnerable workstations.
-
Technician sessions are at risk: SCKit can steal ScreenConnect browser authentication cookies and use console access to distribute payloads to other managed devices.
- Investigate beyond client removal: Check technician and customer endpoints, disable affected extensions, update technician clients, revoke exposed sessions, and remove persistence and unauthorized access.
Remote Support Is Part of the Attack Surface
ScreenConnect helps IT teams and managed service providers fix devices quickly. That convenience also gives attackers a useful path when they compromise an account, server, or extension. In the reported SCKit campaign, attackers used ScreenConnect to install another remote-access client, spread malicious tools, and target technicians who connected to affected devices.
For everyday operations, the lesson reaches beyond one product. Any tool that can reach many computers can magnify a mistake or intrusion. Yet organizations do not need to abandon remote support. They need to know which servers, clients, and extensions they approve, and who can use them. Because many organizations rely on remote-support tools, these checks matter across the wider IT community.
Respond Beyond the First Infected Device
A technician’s workstation can link customer devices to the management console. Therefore, teams should investigate both the affected endpoint and any technician device that connected to it. Removing an unfamiliar client alone may leave behind scheduled tasks, altered settings, or active sign-in sessions.
Instead, verify each client’s destination, update technician software, review console activity, and revoke exposed sessions from a clean device. Also, preserve logs and use a separate response channel if ScreenConnect may be compromised. These steps take effort, but they fit routine security practice: maintain an accurate inventory, limit access, and check what remote tools actually do. SCKit reinforces a practical point in cybersecurity’s ongoing work: trusted tools still need careful oversight.
Expand Your Tech Knowledge
Advance your expertise through insights in Careers & Learning for cybersecurity professionals.
Access comprehensive resources on technology by visiting Wikipedia.
Expert Insights Multi
