SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths
SCKit malware exploits ScreenConnect flaw to target MSPs and technicians.
The SCKit malware campaign targets ConnectWise ScreenConnect deployments by exploiting CVE-2026-84869, an improper privilege management vulnerability. While a patch exists for this specific flaw, the toolkit also hijacks authenticated operator sessions and uses legitimate ScreenConnect features to push malicious code, including a component called RelayTrap that targets technicians' workstations.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ConnectWise?
Get an email when a new story names ConnectWise, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe SCKit campaign demonstrates how a single unpatched privilege escalation vulnerability (CVE-2026-84869) in a widely deployed remote support tool can open the door to full MSP compromise. Beyond the patch gap, attackers also hijack authenticated operator sessions, meaning even patched environments remain at risk if session security is weak. The RelayTrap component specifically targets technicians' workstations, turning the trusted support tool into a lateral movement vector. Because MSPs manage many downstream clients, a successful breach here creates a supply-chain-style multiplier effect, amplifying the blast radius far beyond the initial target.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-84869
- domain — ns.mo7sen.dev
- malware — SCKit