ScreenConnect Exploited via Third-Party Extensions to Deploy SCKit Malware
Attackers leverage vulnerable extensions to compromise 48 organizations and deploy persistent remote access tools.
1Coordinated Campaign Detected
A malicious campaign targeting cloud-hosted ScreenConnect instances was identified on November 11, 2026. Attackers utilized compromised third-party extensions to push rogue clients across 48 organizations. At least 288 managed endpoints were affected within 90 minutes. Security researchers observed the activity originating from three specific ScreenConnect instance IDs during the initial breach.
2Vulnerability in RMM+ Extensions
The attack path centers on a flaw in the RMM+ extension, specifically versions 1.0.31 and 1.0.32. These versions accept blank access keys, allowing unauthorized command execution without requiring multi-factor authentication. Because RMM+ operates independently of standard ScreenConnect user controls, attackers bypassed traditional security layers to issue remote commands directly to endpoints.
3The SCKit Malware Toolkit
Attackers deploy a 16-file toolkit dubbed SCKit to maintain persistent access. The malware installs a secondary, attacker-controlled ScreenConnect client and creates a scheduled task named TrapWatch. It also modifies Microsoft Defender exclusions to evade detection. The payload is delivered via Base64-encoded droppers that fetch PowerShell scripts from remote servers.
4Worm-like Lateral Movement Attempt
The malware is designed to turn infected endpoints into traps for IT technicians. If a technician connects to a compromised machine, the toolkit attempts to infect their workstation, steal session cookies, and hijack the technician's panel access. While this lateral movement mechanism exists in the code, researchers have not observed successful workstation infections.
5ConnectWise Response Measures
ConnectWise has disabled five third-party extensions, including RMM+ and Labtech Plus, across approximately 400 partner environments. The company maintains that its core infrastructure and the ScreenConnect software itself remain uncompromised. Partners are urged to manually disable these extensions, review command history logs, and maintain strict vigilance against any unauthorized remote access.
6Evidence of LLM Usage
Analysis of the SCKit malware reveals that portions of the C# code were likely generated using a large language model. Researchers identified unusually detailed source code comments explaining the functionality of specific scripts. This suggests that the threat actors are incorporating AI-assisted development to refine their malicious toolkits and operational efficiency.
7Sequential Victim Numbering
Attackers have been observed tagging each compromised managed service provider with a sequential number. Researchers noted that the observed tags start partway through a sequence, indicating that additional MSPs may have been compromised prior to the November 11 detection. This pattern suggests a broader, ongoing campaign that likely predates current incident reports.
8Remediation and Safety Advice
Administrators are advised against using ScreenConnect to investigate suspected infections, as this risks exposing their own workstations to the trap. Security teams should use alternative tools to remove rogue clients and clear malware remnants. Simply disabling extensions is insufficient, as machines may become reinfected if the underlying malicious toolkit remains present.