Security · High impactFan score 64 · Tier A
SCKit abuses ScreenConnect to deploy remote access and target technician sessions
Microsoft · By Microsoft Security Research, Sagar Patil & Jeremiah Jasmin ·
The Brief
- ConnectWise reported an active campaign beginning November 11, 2026, in which the SCKit malware abuses ScreenConnect.
- The malware is used to deploy remote access and to target technician sessions, according to Microsoft's security blog.
Why it matters
Attackers who abuse ScreenConnect can gain remote access to systems and target the sessions of technicians who support customers, so developers and IT teams running ScreenConnect should check their exposure.
Who’s affected
- Organizations running ScreenConnect
- #malware
- #remote-access
- #screenconnect
- #connectwise
- #security
In this article ScreenConnect architecture and attack surfaces Attack chain overview Mitigation and protection guidance Indicators of compromise and supporting artifacts References Learn More Beginning on November 11, 2026, ConnectWise reported an active campaign of a threat…
Timeline
ConnectWise reported an active SCKit campaign abusing ScreenConnect
Microsoft Security Blog published analysis of SCKit
Microsoft Security Blog
SCKit abuses ScreenConnect to deploy remote access and target technician sessions