# SCKit abuses ScreenConnect to deploy remote access and target technician sessions

Source: [Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/) · 2026-11-13 · Security
Page: https://themorning.dev/story/sckit-abuses-screenconnect-to-deploy-remote-access-and-target-technician-session-78498214505c5f31
Kind: security · Impact: high

## In brief

- ConnectWise reported an active campaign beginning November 11, 2026, in which the SCKit malware abuses ScreenConnect.
- The malware is used to deploy remote access and to target technician sessions, according to Microsoft's security blog.

## Why it matters

Attackers who abuse ScreenConnect can gain remote access to systems and target the sessions of technicians who support customers, so developers and IT teams running ScreenConnect should check their exposure.

## Timeline

- 2026-11-11: ConnectWise reported an active SCKit campaign abusing ScreenConnect
- 2026-11-13: Microsoft Security Blog published analysis of SCKit

## Coverage

- [SCKit abuses ScreenConnect to deploy remote access and target technician sessions](https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/) — Microsoft Security Blog, 2026-11-13

Tags: malware, remote-access, screenconnect, connectwise, security

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev