Overview
A new worm-like malware toolkit called SCKit has been discovered targeting Managed Service Providers (MSPs) through ScreenConnect, with attackers attempting to turn an infected customer endpoint into a pathway into the MSP technician’s workstation and potentially other customer environments. At least 288 endpoints across 48 organisations were reportedly targeted during the campaign, although researchers have not confirmed successful exploitation of the worm-like mechanism.
What Happened
Attackers gained access to ScreenConnect environments and used its Run Command capability to deploy unauthorised ScreenConnect clients onto customer systems. Huntress believes the initial access may have involved the third-party RMM+ extension, where versions 1.0.31 and 1.0.32 contained an authentication weakness that could allow commands to be issued without normal ScreenConnect authentication or MFA when an access key had never been configured.
How SCKit Spreads
The most concerning capability is RelayTrap, which waits for an MSP technician to establish a ScreenConnect session with an infected machine. It then attempts to exploit CVE-2026-84869, a previously patched ScreenConnect client vulnerability, to send a malicious file from the customer’s machine back to the technician’s workstation. If successful, the attack could potentially move from one customer’s environment into the MSP and then use the technician’s management privileges to reach additional customers.
The Credential Risk
SCKit also attempts to steal ScreenConnect authentication cookies from browsers. This is significant because an attacker obtaining an existing authenticated session may be able to operate with the technician’s existing permissions without needing to steal their password or trigger another MFA challenge. The malware can then attempt to enumerate accessible endpoints and abuse legitimate ScreenConnect features such as the Shared Toolbox.
Has the Worm Actually Worked?
Importantly, researchers have not confirmed successful exploitation of the worm-like propagation technique in this campaign. Huntress and Blackpoint Cyber tested the RelayTrap mechanism against patched ScreenConnect clients and found that the malicious file transfer was queued but the current client did not execute the payload. This means the technique is a serious warning for MSPs, but it should not be interpreted as confirmed widespread self-propagation.
What MSPs Should Do
MSPs should immediately review ScreenConnect environments for unauthorised Access clients, unexpected Run Command activity, suspicious Toolbox usage and unfamiliar administrative sessions. Disable affected third-party extensions, ensure ScreenConnect clients are fully patched and review browser sessions and authentication cookies on technician workstations where compromise is suspected. Avoid connecting interactively to potentially infected customer systems during investigation and use separate security tools where possible.
Expert in the Cloud Insight
For an MSP, one compromised endpoint can potentially become a compromise of the entire customer ecosystem. The real danger demonstrated by SCKit is not simply another piece of malware; it is the abuse of trusted remote-management relationships. MSPs should therefore treat RMM and remote-support platforms as high-value security infrastructure, enforce MFA and least privilege, tightly control third-party extensions, separate customer environments and continuously monitor technician accounts and management sessions.
Expert in the Cloud – The Future Is Now.
Leave a Reply