SCKit malware abuses ScreenConnect for remote access

Tier A · Patch today – Before you go home

Who’s exposed: ScreenConnect deployments and their technician sessions

Tier A because: Core infrastructure or popular tool AND exploited in the wild

Reach

Attack

Damage

Fix

Popular tool · Exploited in the wild

The Brief

ConnectWise reported an active campaign beginning November 11, 2026, in which the SCKit malware abuses ScreenConnect.
The malware is used to deploy remote access and to target technician sessions, according to Microsoft's security blog.

Why it matters

Attackers who abuse ScreenConnect can gain remote access to systems and target the sessions of technicians who support customers, so developers and IT teams running ScreenConnect should check their exposure.

The checklist behind the tier

Checklist · 3 of 10 yes

Yes	Hits tech teams	Judgment: ScreenConnect is remote access software that IT and ops teams run and manage.
No	Core infrastructure	Judgment: a single vendor's remote access product, not software nearly every team runs.
Yes	Popular tool	Judgment: ScreenConnect is widely deployed by managed service providers and IT teams.
Yes	Exploited in the wild	Microsoft Security Blog: ConnectWise reported an active campaign beginning November 11, 2026.
No	Public exploit	Microsoft Security Blog excerpt says nothing about published exploit code or PoC.
No	Remote, no login	Microsoft Security Blog excerpt does not state whether unauthenticated network access suffices.
No	Full takeover	Microsoft Security Blog says SCKit deploys remote access and targets technician sessions; code execution or admin takeover not explicitly stated.
No	Secrets exposed	Microsoft Security Blog excerpt does not report stolen credentials, tokens, configs or customer data.
No	Supply chain	Microsoft Security Blog describes malware abusing ScreenConnect; no compromised package, update or pipeline is reported.
No	No fix yet	Microsoft Security Blog excerpt does not state whether a patched version is available.

Timeline

Nov 11
ConnectWise reported an active SCKit campaign abusing ScreenConnect
Nov 13
Microsoft Security Blog published analysis of SCKit
Nov 13 · 9:31 PM
Microsoft Security Blog
SCKit abuses ScreenConnect to deploy remote access and target technician sessions

Source

SCKit abuses ScreenConnect to deploy remote access and target technician sessions ↗ Microsoft Security Blog · 2h ago

First seen 2h ago · 1 source · Full story page · How tiers are decided