SCKit campaign hits 288 ScreenConnect endpoints at 48 organizations
November 12: BleepingComputer says SCKit is a 16-part toolkit whose RelayTrap uses CVE-2026-84869, patched in 26.6.5; the payload failed on a patched client, and comments looked LLM-generated.
Huntress says SCKit hit at least 288 endpoints at 48 organizations; the access path is disputed, and technician spread is unconfirmed.
Huntress says attackers reached cloud-hosted ConnectWise ScreenConnect environments on November 11 and installed rogue clients and the SCKit toolkit on at least 288 endpoints at 48 organizations, including six MSPs. Huntress attributes access to third-party RMM+ 1.0.31 and 1.0.32, which accepted a blank access key and bypassed accounts and MFA. ConnectWise says it found no ScreenConnect flaw or infrastructure compromise and disabled five related extensions in about 400 partner environments. The Hacker News and The Record, citing Blackpoint, say SCKit also tries to use patched CVE-2026-84869; a fully patched client blocked that payload, and Huntress has not seen spread to technician workstations. BleepingComputer reported the flaw was fixed in ScreenConnect 26.6.5 and stolen browser cookies could still reuse a technician session.
- Activity began about 17:47 UTC on November 11, 2026, according to Huntress.
- Counts rose from 286 endpoints at 47 organizations to 288 across 48.
- Named ScreenConnect builds include 26.6.6.9747 and 26.7.6.9783.
- ConnectWise disabled Labtech Plus, RMM Plus, RMM+, and two password-link extensions.
- CISA added CVE-2026-84869 to KEV on September 11, 2026.
- About one third of hosts were hit in 10 minutes; all within 90.
Timeline
dated events in the reporting · oldest first- Jul 25, 2026A Social Security-themed script referenced a rogue client ID. · BleepingComputer
- Sep 11, 2026CISA added CVE-2026-84869 to the KEV catalog. · The Hacker News
- Sep 14, 2026Federal agency deadline to remediate CVE-2026-84869. · The Hacker News
- Nov 11, 2026Huntress first saw the ScreenConnect campaign around 17:47 UTC. · Huntress
What each outlet adds
beyond the shared facts- BleepingComputerSCKit is 16 parts; RelayTrap comments look LLM-generated; fix in 26.6.5.
- HuntressBlank RMM+ access key bypassed MFA; five extensions were disabled.
- The Hacker NewsCVE-2026-84869 scored 9.9; Blackpoint found no extension link.
- The RecordOn-premises customers must disable RMM+ themselves.
- SecurityWeekHuntress and ConnectWise both released indicators of compromise.
- CVEs
- CVE-2026-84869
- Vendors
- ConnectWise
- Products
- ScreenConnectRMM+Labtech Plus
- Organizations
- Blackpoint CyberCISAHuntress
Coverage
oldest first · one row per article · UTC- · 1d ago
BleepingComputerFirst report
ScreenConnect campaign compromises MSPs and customer endpoints
Huntress is tracking six MSPs and 286 endpoints across 47 organizations, with the count still rising.
- · 22h ago
Huntress
SCKit worm installs rogue ScreenConnect clients via RMM+ flaw
A blank access key in RMM+ 1.0.31 and 1.0.32 let attackers bypass MFA and hit 48 organizations.
- · 20h ago
Cyber Security News
Attackers hijack ScreenConnect panels to push SCKit to 288 devices
Huntress saw all 288 hosts hit in about 90 minutes on November 11; ConnectWise says it found no product flaw.
- · 19h ago
The Hacker News
ConnectWise disables five extensions after rogue ScreenConnect client attacks
Huntress first saw the activity on November 11 and has not observed a successful jump to a technician workstation.
- · 19h ago
GBHackers
SCKit worm infects 288 ScreenConnect endpoints at 48 organizations
Huntress says all 288 hosts were hit within 90 minutes and the console-takeover jump has not succeeded.
- · 13h ago
SecurityWeek
ScreenConnect campaign compromises 288 hosts through RMM+ authentication flaw
Huntress says attackers hit at least six MSPs and 48 organizations within 90 minutes on November 11, deploying SCKit.
- · 11h ago
DataBreaches.net
ScreenConnect campaign compromises MSPs and customer devices
Huntress reports six compromised MSPs and 286 endpoints across 47 organizations, with the victim count still rising.
- · 11h ago
The Register · Security
Attackers exploit ScreenConnect plugin flaw to infect 288 machines
RMM+ 1.0.31 and 1.0.32 accept a blank access key, letting attackers run commands without defeating MFA.
- · 11h ago
SCKit exploits patched ScreenConnect flaw to pivot via support sessions
A fully patched client blocked the CVE-2026-84869 payload, but stolen operator sessions can still spread commands.
- · 8h ago
The Record
ConnectWise investigates ScreenConnect breaches at nearly 50 organizations
Huntress saw 288 endpoints hit in 90 minutes; researchers link a toolkit to CVE-2026-84869.
- · 3h ago
CyberScoop
Rogue ScreenConnect clients spread through RMM+ add-on, researchers say
ConnectWise disabled five extensions in about 400 partner environments after SCKit reached 288 computers at 48 organizations.
- · 1h ago
Worm-like SCKit malware targets MSPs through ScreenConnect
Huntress links initial access to a blank-key flaw in RMM+ 1.0.31 and 1.0.32, hitting 288 endpoints at 48 organizations.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84869 | Missing authorization in ScreenConnect client allows unauthorized file execution | 9.9 | <1% | KEV | KEV |