SCKit exploits patched ScreenConnect flaw to pivot via support sessions
Original title: SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths
A fully patched client blocked the CVE-2026-84869 payload, but stolen operator sessions can still spread commands.
Blackpoint Cyber said an ongoing campaign against ConnectWise ScreenConnect uses SCKit to exploit CVE-2026-84869, a patched improper privilege management flaw scored 9.9, not a new bug. Testing on a fully patched client blocked the exploit payload. The toolkit can also hijack authenticated operator sessions, deploy unauthorized Access clients, and use RelayTrap to target connecting technicians and steal .ASPXAUTH cookies. There is no evidence the patch was bypassed or that a technician workstation was successfully compromised.
Unconfirmed: No evidence yet of successful technician compromise or of a patch bypass; ConnectWise had not commented.
- CVE-2026-84869 allows file transfer and execution in an active remote session without host confirmation.
- SCKit downloads sc.msi, runs sckit-run.bat, and fetches components from ns.mo7sen.dev.
- CISA added the flaw to KEV on September 11, 2026, with a September 14 agency deadline.
- ConnectWise disabled five third-party extensions; Blackpoint found no link to SCKit.
- The same CVE was previously used to deliver an XMRig miner.
Impact: Unauthorized file execution and spread via stolen operator sessions
| Product | Affected |
|---|---|
| ConnectWise ScreenConnect | — |
- 1.Apply the existing ScreenConnect patch that blocks CVE-2026-84869.
- 2.Treat compromised operator sessions as still able to push commands after patching.
- CVEs
- CVE-2026-84869
- ATT&CK
- T1059.001 PowerShellT1539 Steal Web Session CookieT1219 Remote Access SoftwareT1190 Exploit Public-Facing Application
- Vendors
- ConnectWise
- Products
- ScreenConnect
- Organizations
- Blackpoint CyberCISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84869 | Missing authorization in ScreenConnect client allows unauthorized file execution | 9.9 | <1% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | mo7sen.dev | n.bat"). The batch script dropper subsequently contacts "ns.mo7sen[.]dev" to fetch a PowerShell decoder ("sckit-decoder.ps1") and |
From the original article
6 min read at thehackernews.com
The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged. Blackpoint Cyber's Adversary Pursuit Group (APG), which shared the details with The Hacker News, said the recovered attacker toolkit exploits CVE-2026-84869 (CVSS score: 9. 9), an
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.