New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks
New SCKit malware targets MSPs via ScreenConnect attacks, exploiting a vulnerability to spread.
A new worm-like malware toolkit named SCKit has been observed in recent ScreenConnect attacks targeting managed service providers (MSPs). The malware is designed to spread from infected customer devices to MSP technicians' computers, potentially compromising additional managed networks. Researchers noted that while SCKit attempts to exploit a patched ScreenConnect vulnerability (CVE-2026-84869), exploitation of this specific flaw was not observed, with the exploit failing in testing. The initial access is believed to have been through an authentication flaw in the RMM+ ScreenConnect extension.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ConnectWise?
Get an email when a new story names ConnectWise, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA worm-like malware toolkit called SCKit is targeting managed service providers by exploiting an authentication vulnerability in the RMM+ ScreenConnect extension, designed to spread laterally from compromised customer environments to MSP technician machines and beyond. Because MSPs hold privileged access to dozens or hundreds of client networks, a single compromised technician workstation can cascade into a multi-organization breach. The initial foothold came not from the patched CVE but from an unmitigated authentication flaw in a third-party extension, highlighting that patching the core product is insufficient if ancillary components remain vulnerable. This incident underscores the disproportionate risk posed by trusted remote management tools when access controls and patch hygiene are not applied comprehensively across all integrated components.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-84869