ScreenConnect attacks on IT service providers carried a worm-like toolkit and reached 288 machines in 90 minutes
Researchers linked the "SCKit" malware to a third-party extension. ConnectWise says it found no flaw in ScreenConnect itself.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
Researchers have found a worm-like malware toolkit called SCKit in this week's attacks on cloud-hosted ScreenConnect environments used by managed service providers. SCKit is designed to spread from infected customer devices to the workstations of the technicians who connect to them. It tries to do this by exploiting CVE-2026-84869, a previously patched ScreenConnect vulnerability. Huntress and Blackpoint Cyber say they have not seen this step succeed, and Blackpoint says the exploit failed in testing against a patched client. According to Huntress's updated count, the intruder used access to several ScreenConnect panels to push rogue remote-access clients to at least 288 endpoints across 48 organizations. About a third were reached within the first 10 minutes, and all of them within about 90 minutes. Researchers linked the toolkit to one of five independently developed extensions, which ConnectWise has disabled in about 400 partner environments. ConnectWise says it has found no evidence that its own infrastructure was compromised or that ScreenConnect has a vulnerability. Its initial assessment is that the attacker abused third-party extensions. The case shows how add-ons to remote-management tools can expose many customer networks at once.