Attackers use compromised ScreenConnect panels to push rogue clients and SCKit malware; reporting counts 6 MSPs, 288 endpoints and 48 downstream organizations. SCKit abuses Run Command and a RelayTrap component to reach the technician's workstation and session cookies; the CVE-2026-84869 patch blocks it.
🚨 Hackers are breaching MSPs through compromised ScreenConnect panels, deploying rogue remote access tools to customer devices. @HuntressLabs reports 6 compromised MSPs and 286 affected endpoints across 47 organizations, with the numbers rising. Attackers ca
‼️ Hackers are abusing ScreenConnect to push rogue clients delivering SCKit malware. At least 288 endpoints across 48 organizations were targeted, Huntress reports. ConnectWise has disabled 5 third-party extensions. Attack details + IoCs → https://thehacker
Hackers Deploy Malware in Fresh ScreenConnect Campaign
🚨 ScreenConnect attackers have a new target: IT support technicians. SCKit malware exploits a patched 9.9-rated flaw and attempts to hijack technician sessions to spread across MSP customer networks. The patch blocks the exploit but not session hijacking. D
SCKit abuses ScreenConnect Run Command and a RelayTrap component to pivot from a managed endpoint into the technician's workstation and session cookies. The CVE-2026-84869 patch blocks the exploit. - Vulnerability status: CVE-2026-84869 (CVSS 9.9) is an impro
Why this score
Plan rubric with caps (verified sweep, Nov 12)