# ScreenConnect Exploited via Third-Party Extensions to Deploy SCKit Malware Attackers leverage vulnerable extensions to compromise 48 organizations and deploy persistent remote access tools. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-11-12 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/0382bcd3-6acd-4e04-828d-6b2f331bf84a ## Coordinated Campaign Detected A malicious campaign targeting cloud-hosted ScreenConnect instances was identified on November 11, 2026. Attackers utilized compromised third-party extensions to push rogue clients across 48 organizations. At least 288 managed endpoints were affected within 90 minutes. Security researchers observed the activity originating from three specific ScreenConnect instance IDs during the initial breach. ## Vulnerability in RMM+ Extensions The attack path centers on a flaw in the RMM+ extension, specifically versions 1.0.31 and 1.0.32. These versions accept blank access keys, allowing unauthorized command execution without requiring multi-factor authentication. Because RMM+ operates independently of standard ScreenConnect user controls, attackers bypassed traditional security layers to issue remote commands directly to endpoints. ## The SCKit Malware Toolkit Attackers deploy a 16-file toolkit dubbed SCKit to maintain persistent access. The malware installs a secondary, attacker-controlled ScreenConnect client and creates a scheduled task named TrapWatch. It also modifies Microsoft Defender exclusions to evade detection. The payload is delivered via Base64-encoded droppers that fetch PowerShell scripts from remote servers. ## Worm-like Lateral Movement Attempt The malware is designed to turn infected endpoints into traps for IT technicians. If a technician connects to a compromised machine, the toolkit attempts to infect their workstation, steal session cookies, and hijack the technician's panel access. While this lateral movement mechanism exists in the code, researchers have not observed successful workstation infections. ## ConnectWise Response Measures ConnectWise has disabled five third-party extensions, including RMM+ and Labtech Plus, across approximately 400 partner environments. The company maintains that its core infrastructure and the ScreenConnect software itself remain uncompromised. Partners are urged to manually disable these extensions, review command history logs, and maintain strict vigilance against any unauthorized remote access. ## Evidence of LLM Usage Analysis of the SCKit malware reveals that portions of the C# code were likely generated using a large language model. Researchers identified unusually detailed source code comments explaining the functionality of specific scripts. This suggests that the threat actors are incorporating AI-assisted development to refine their malicious toolkits and operational efficiency. ## Sequential Victim Numbering Attackers have been observed tagging each compromised managed service provider with a sequential number. Researchers noted that the observed tags start partway through a sequence, indicating that additional MSPs may have been compromised prior to the November 11 detection. This pattern suggests a broader, ongoing campaign that likely predates current incident reports. ## Remediation and Safety Advice Administrators are advised against using ScreenConnect to investigate suspected infections, as this risks exposing their own workstations to the trap. Security teams should use alternative tools to remove rogue clients and clear malware remnants. Simply disabling extensions is insufficient, as machines may become reinfected if the underlying malicious toolkit remains present. ## Sources covering this story - [The Hacker News — ScreenConnect Exploited to Deploy Rogue Clients Across 48 Organizations](https://thehackernews.com/2026/11/screenconnect-attacks-target-at-least.html) - [www.theregister.com - Articles (theregister.co.uk) — Hackers Exploit ScreenConnect Plugin Flaw to Deploy Malware](https://www.theregister.com/security/2026/11/12/hackers-exploiting-screenconnect-plugin-flaw-to-spread-malware-across-hundreds-of-pcs/5309361) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._