Worm-like SCKit malware targets MSPs through ScreenConnect
Huntress links initial access to a blank-key flaw in RMM+ 1.0.31 and 1.0.32, hitting 288 endpoints at 48 organizations.
78
- Mentions · 7d8
- Mentions · 30d8
- All mentions8
- First seenNov 12, 2026
- Last mentioned1h ago
Timeline
8 articles · newest firstRogue ScreenConnect clients spread through RMM+ add-on, researchers say
ConnectWise disabled five extensions in about 400 partner environments after SCKit reached 288 computers at 48 organizations.
74
ConnectWise investigates ScreenConnect breaches at nearly 50 organizations
Huntress saw 288 endpoints hit in 90 minutes; researchers link a toolkit to CVE-2026-84869.
78
Attackers exploit ScreenConnect plugin flaw to infect 288 machines
RMM+ 1.0.31 and 1.0.32 accept a blank access key, letting attackers run commands without defeating MFA.
78
ScreenConnect campaign compromises 288 hosts through RMM+ authentication flaw
Huntress says attackers hit at least six MSPs and 48 organizations within 90 minutes on November 11, deploying SCKit.
76
SCKit worm infects 288 ScreenConnect endpoints at 48 organizations
Huntress says all 288 hosts were hit within 90 minutes and the console-takeover jump has not succeeded.
76
ConnectWise disables five extensions after rogue ScreenConnect client attacks
Huntress first saw the activity on November 11 and has not observed a successful jump to a technician workstation.
76
SCKit worm installs rogue ScreenConnect clients via RMM+ flaw
A blank access key in RMM+ 1.0.31 and 1.0.32 let attackers bypass MFA and hit 48 organizations.
82
Related CVEs
by mentions- CVE-2026-84869<1%9.9Missing authorization in ScreenConnect client allows unauthorized file execution
Appears with
- ConnectWisevendor · 8
- ScreenConnectproduct · 8
- Huntressorganization · 8
- SCKitmalware · 7
- Blackpoint Cyberorganization · 2
- TrapWatchmalware · 1
- Labtech Plusproduct · 1
- RelayTrapmalware · 1
- CISAorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.