# SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths

Source: [The Hacker News](https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html) · 2026-11-12 · Security
Page: https://themorning.dev/story/sckit-malware-turns-screenconnect-support-sessions-into-potential-msp-attack-pat-daa356fef18a497b
Kind: security · Impact: high

## In brief

- ConnectWise is investigating an active malware campaign against managed service providers that abuses compromised ScreenConnect environments to deploy rogue remote-access clients on customer devices.
- Researchers report at least 288 endpoints across 48 organizations affected, and ConnectWise says nearly 50 organizations had intrusions.
- ConnectWise disabled five third-party ScreenConnect extensions in partner environments; attackers used a flawed legitimate extension to bypass authentication, per SecurityWeek.

## Why it matters

Attackers can reach customer machines through trusted MSP remote-management tooling, and the reported campaign has been linked to ransomware deployment, so MSPs and their customers face a wide blast radius.

## What to do

- Check ScreenConnect environments for unauthorized rogue remote-access clients
- Review installed third-party ScreenConnect extensions and disable any that are not needed or trusted

## Timeline

- 2026-11-11: ConnectWise investigates active malware campaign targeting MSPs via ScreenConnect
- 2026-11-12: ConnectWise disables five third-party extensions in partner environments

## Coverage

- [ConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations](https://therecord.media/connectwise-screenconnect-breaches-third-party-tool) — The Record from Recorded Future News, 2026-11-12
- [SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths](https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html) — The Hacker News, 2026-11-12
- [Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs](https://www.theregister.com/security/2026/11/12/hackers-exploiting-screenconnect-plugin-flaw-to-spread-malware-across-hundreds-of-pcs/5309361) — www.theregister.com - Articles, 2026-11-12
- [Hackers Deploy Malware in Fresh ScreenConnect Campaign](https://www.securityweek.com/hackers-deploy-malware-in-fresh-screenconnect-campaign/) — SecurityWeek, 2026-11-12
- [ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients](https://thehackernews.com/2026/11/screenconnect-attacks-target-at-least.html) — The Hacker News, 2026-11-12
- [Active ScreenConnect attacks breach MSPs, impact dozens of organizations](https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/) — BleepingComputer, 2026-11-11

Tags: screenconnect, msp, malware, supply-chain, ransomware, remote-access

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev