SCKit abuses ScreenConnect to deploy remote access and target technician sessions
Microsoft has confirmed an active campaign where threat actors abuse ConnectWise ScreenConnect to deploy the SCKit malware, targeting IT support technician sessions.
Beginning on November 11, 2026, ConnectWise reported an active campaign where a threat actor gains unauthorized access to cloud-hosted ConnectWise ScreenConnect instances belonging to managed service providers (MSPs). Microsoft Threat Intelligence has confirmed this activity and observed threat actors abusing ScreenConnect to install unauthorized remote-access clients and deploy the malicious SCKit worm on customer endpoints.
The malware deployment starts with commands issued through ScreenConnect to silently install an identical client connected to threat actor-controlled infrastructure. A batch launcher retrieves a PowerShell decoder that decrypts and extracts SCKit using device-specific key material. The toolkit establishes persistence through scheduled tasks and registry Run entries and deploys RelayTrap, which targets connecting technicians.
Attack methodology
ScreenConnect, a remote-support platform used by MSPs, has three main components: a management instance, technician workstations, and customer endpoints. The worm specifically targets IT support technician workstations using hijacked authenticated ScreenConnect sessions, then uses the victim's management console to distribute payloads to other managed devices.
The resulting access to either target enables threat actors to remotely administer affected endpoints, execute commands, and deploy further tools independently of the legitimate support instance.
Entry points
ConnectWise identified an authentication flaw in RMM+ versions 1.0.31 and 1.0.32 where the extension accepted an empty access key when none was configured. This vulnerability allowed unauthorized callers to submit commands to the server's API for delivery to managed endpoints without normal authentication. ConnectWise is investigating extension abuse as an initial access route.
A separate attack path exists from customer endpoints to technicians through RelayTrap, a malicious replacement for the ScreenConnect client. When a technician connects for support, RelayTrap delivers a payload to their workstation. ConnectWise states that their fix for CVE-2026-84869 blocks this client-side attack.
Deployment process
The attack chain begins with ScreenConnect commands that install an additional client on the customer endpoint. This client connects to an attacker-controlled ScreenConnect instance, creating a separate remote-access channel. Further commands stage the toolkit by downloading a PowerShell decoder that retrieves and executes additional components.
The decoder uses the device's MachineGuid to derive a decryption key, then decrypts and extracts the SCKit bundle. The bundle includes components for persistence, payload distribution, and targeting technicians. RelayTrap establishes persistence through scheduled tasks and registry entries, monitoring for technician connections to deliver malicious payloads.
Microsoft recommends that defenders investigate technician workstations and downstream affected endpoints, noting that removing an unauthorized client alone doesn't remove the toolkit's persistence or invalidate exposed web sessions. The company has provided indicators of compromise and Microsoft Defender XDR queries to help organizations identify and disrupt this activity.
Related
