SCKit Malware Exploits ScreenConnect Support Sessions to Target MSP Networks and Technicians

Cybersecurity researchers have uncovered a malicious toolkit known as SCKit, which targets ConnectWise ScreenConnect remote access deployments and could allow attackers to turn legitimate technical support sessions into pathways for compromising multiple customer networks.

The investigation revealed that the ongoing attacks exploit a previously identified and patched critical security vulnerability in ScreenConnect rather than a newly discovered flaw.

According to Blackpoint Cyber’s Adversary Pursuit Group (APG), the toolkit exploits CVE-2026-84869, a vulnerability rated 9.9 on the Common Vulnerability Scoring System (CVSS). The security weakness involves improper privilege management and missing authorisation checks, potentially allowing attackers to transfer files and execute commands through active remote sessions without proper permission or confirmation from the host.

However, Blackpoint Cyber said its testing confirmed that fully patched ScreenConnect clients successfully block the exploit payload.

Researchers Sam Decker and Nevan Beal explained that although applying the available security update prevents exploitation of the known vulnerability, it does not eliminate the danger posed by compromised administrator sessions.

They warned that SCKit contains additional capabilities designed to hijack authenticated operator sessions and abuse legitimate ScreenConnect management features to distribute malicious commands.

One of the toolkit’s most concerning components is called RelayTrap. It is designed to exploit the trust between technicians and managed computer systems by attempting to infect the workstations of support personnel who connect to compromised devices during investigations.

The attack begins by using ScreenConnect’s built-in Run Command functionality to execute malicious instructions. The toolkit first checks whether ScreenConnect is already installed before downloading and launching a malicious MSI installer named “sc.msi”.

The installer subsequently deploys a batch script called “sckit-run.bat”, which contacts an attacker-controlled server to retrieve a PowerShell decoder named “sckit-decoder.ps1”.

The decoder then deploys different components of the SCKit toolkit, including a PowerShell script called “SilentForceInstall-WithUninstall.ps1”. This component establishes persistent remote access by installing two unauthorised ScreenConnect Access clients.

Additional scripts and C# code are also deployed to interfere with existing ScreenConnect Guest sessions, including through the RelayTrap functionality.

According to Blackpoint Cyber, RelayTrap attempts to exploit the guest-to-host file execution technique associated with CVE-2026-84869. It does this by replacing the legitimate ScreenConnect Guest component and sending the malicious payload towards the technician connecting to the infected endpoint.

If successful, the toolkit attempts to recover the technician’s authenticated ScreenConnect browser sessions and use the existing administrative permissions to execute commands across other devices accessible to that technician.

This creates a potentially dangerous situation for Managed Service Providers (MSPs), whose technicians routinely connect to computer systems belonging to multiple customers.

Rather than limiting the attack to one compromised endpoint, the malware attempts to use the technician’s workstation and authenticated management access to reach additional customer environments.

Blackpoint Cyber explained that commands executed through existing ScreenConnect agents could run under the NT AUTHORITY\SYSTEM security context, allowing attackers to install additional software without establishing a separate execution method on every affected computer.

The unauthorised Access clients provide persistent control over compromised endpoints, while RelayTrap attempts to turn legitimate support connections into opportunities to spread the infection.

Researchers said the toolkit also searches the technician’s local browser data and process memory for authenticated management sessions, including .ASPXAUTH cookies. These stolen sessions could potentially allow attackers to propagate the malware to other systems without obtaining separate login credentials.

The investigation suggests that technicians are particularly attractive targets because their computers may contain access to administrative tools and multiple customer environments.

Blackpoint Cyber warned that organisations should not focus exclusively on the initially compromised computer but should also examine the wider management relationship, including technician workstations, remote access installations, administrative command histories and browser sessions.

The vulnerability, CVE-2026-84869, had previously been exploited in attacks involving malicious ScreenConnect clients that distributed a multi-stage Visual Basic Script payload before deploying the XMRig cryptocurrency miner.

The US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalogue on September 11, 2026, directing federal agencies to apply the necessary security fixes by September 14.

In response to the latest incident, ConnectWise temporarily disabled five third-party extensions in partner environments as a precaution. Blackpoint Cyber, however, said it had not established a technical connection between those extensions and the SCKit toolkit.

Huntress Identifies Authentication Flaw in RMM+ Extension

Further developments emerged after cybersecurity firm Huntress identified a serious authentication weakness in versions 1.0.31 and 1.0.32 of RMM+, one of the third-party ScreenConnect extensions disabled by ConnectWise.

According to Huntress, the affected versions could accept an empty access key when an administrator had not configured one, potentially allowing unauthorised commands to be executed without passing through ScreenConnect’s normal authentication protections.

RMM+ allows external tools to manage ScreenConnect sessions without requiring technicians to operate directly through the platform’s console. It uses a shared access key known as RMMPlus.AccessKey, which is stored in the extension’s settings.

However, Huntress found that the access key defaulted to a blank value in the affected versions.

Because RMM+ operates separately from ScreenConnect’s regular user accounts, roles and authentication controls, the weakness could potentially allow attackers to execute commands on connected devices without bypassing multi-factor authentication.

Huntress said it observed commands reaching endpoints across several ScreenConnect instances within minutes, without corresponding login activity. The commands appeared in the reviewed logs as actions associated with RMM+.

Blackpoint Cyber’s investigation also found that malicious ScreenConnect extensions may have played a role in the initial access, although researchers said they did not yet have enough forensic evidence to establish the precise entry point.

The company stressed that the toolkit’s ability to exploit CVE-2026-84869 does not prove that an unpatched ScreenConnect client was responsible for the initial compromise.

Blackpoint Cyber said November 11 marked the earliest publicly reported activity identified during its investigation, but it could not rule out earlier incidents.

ConnectWise Confirms Investigation

ConnectWise acknowledged reports of malicious activity affecting a limited number of ScreenConnect partners and said it was actively investigating the incident.

A company spokesperson said its preliminary assessment suggested that attackers may have abused independent third-party extensions installed in partner environments, although the initial access method had not been conclusively established.

The company confirmed that it had disabled the identified extensions where possible and advised on-premises partners to disable them immediately.

ConnectWise also cautioned that the presence of the extensions alone does not necessarily mean that an organisation has been compromised. Partners were advised to consult precautionary guidance published through the company’s Trust Center.

As of the latest findings, researchers had not established that the attackers successfully propagated the malware to a technician’s workstation or bypassed the security patch for CVE-2026-84869.

The incident highlights the security risks associated with remote management platforms, particularly where technicians have access to multiple customer environments.

Blackpoint Cyber advised MSPs to strengthen protection around authenticated management sessions, introduce additional verification for high-impact administrative operations and closely monitor suspicious remote access installations.

The researchers emphasised that securing the remote management platform alone is not enough. Organisations must also protect the technicians, browser sessions and administrative privileges that connect multiple customer networks.