Covered by 2 outlets — first reported by The Hacker News, Nov 12, 13:08 UTC
SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths
MentionsConnectWiseScreenConnect
Summary
A toolkit named SCKit was used in the recent attacks on managed service providers that run ConnectWise ScreenConnect remote-access software. Blackpoint Cyber says the recovered toolkit exploits CVE-2026-84869, a critical flaw rated 9.9 that has since been patched, rather than a new vulnerability. BleepingComputer reports the malware is worm-like and is designed to spread from infected customer devices to MSP technicians' computers, so that it can reach further managed networks.
AI summary by the SecurityTabs newsroom, checked against The Hacker News, BleepingComputer. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
The Hacker NewsFirst report
SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths
The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged.
BleepingComputer
New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks
A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians' computers and compromise…
Explained
The technology and terms in this story. Learn more
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.