SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints

Attackers exploited a critical authentication bypass vulnerability in the RMM+ ScreenConnect extension, where a blank access key was sufficient to circumvent security controls — a fundamental access control failure. Because RMM tools have privileged access to managed endpoints by design, a single compromised extension cascaded across 288 hosts in 48 organizations. The flaw existed in specific versions (1.0.31 and 1.0.32) that remained deployed in production environments, highlighting the danger of unpatched third-party extensions within trusted remote management platforms. This incident demonstrates that supply-chain-adjacent tooling — third-party extensions that plug into critical infrastructure — can become a force multiplier for attackers when not rigorously maintained and monitored.