Attackers used cloud-hosted ScreenConnect panels to install rogue remote-access clients and a malware toolkit called SCKit on at least 288 endpoints across 48 organizations, according to Huntress. The security firm said it first observed the activity on November 11, 2026, and saw all 288 hosts affected within about 90 minutes, with roughly one-third targeted in the first 10 minutes.
Huntress said the operator used ScreenConnect’s Run Command feature to send instructions to groups of managed endpoints with SYSTEM privileges. The commands silently installed an attacker-controlled ScreenConnect client before downloading an encrypted 16-file SCKit package containing PowerShell scripts, batch files, Windows command-line files and configuration data. The toolkit creates a RelayTrap directory, adds Microsoft Defender exclusions, installs a scheduled task called TrapWatch and replaces the legitimate ScreenConnect client with another instance controlled by the attackers.
SCKit also contains code designed to turn an infected customer device into a route toward an MSP technician’s workstation. Its RelayTrap component waits for a technician to connect, then attempts to send a malicious file back to the technician by abusing CVE-2026-84869, a file-transfer flaw ConnectWise fixed in ScreenConnect client version 26.6.5 on September 8, 2026. ConnectWise says clients running 26.6.5 or later block this endpoint-to-technician spread technique. Other components attempt to steal the technician’s ScreenConnect browser session cookie and reuse the existing session to push commands to additional customer endpoints through the platform’s Shared Toolbox. Huntress said it has not observed this second-stage spread succeeding, and every recovered host log it reviewed showed the console-takeover attempt failing. Blackpoint Cyber also said its test against a current ScreenConnect client did not achieve reverse execution or bypass the existing fix.
The activity appears linked to the third-party RMM+ extension rather than a new flaw in ScreenConnect itself. Huntress traced commands to RMM+ and found that versions 1.0.31 and 1.0.32 accepted a blank access key when an administrator had not configured one, bypassing ScreenConnect’s normal user accounts, roles and multifactor authentication. The weakness is described in this report on the RMM+ extension flaw. ConnectWise’s latest advisory now references CVE-2026-127063, a CVSS 9.3 issue in the third-party extension. The CVE record describes a default API-secret problem in RMM+ and says the core ScreenConnect server and client are not affected.
ConnectWise said it disabled five related third-party extensions in approximately 400 partner environments as a precaution, while stressing that the presence of an extension does not establish that an environment was compromised. The company said it has found no evidence that its own infrastructure was breached or that initial access involved a ScreenConnect vulnerability. The initial access method and full scope remain under investigation, and ConnectWise said it does not have visibility into activity inside partner environments after initial access.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
