# SCKit targets support technicians in ScreenConnect attacks

_Published Thursday, November 12, 2026 at 6:31 PM EST · Security · Latest · Tier 2 — Notable_

![SCKit targets support technicians in ScreenConnect attacks — Primary](https://www.bleepstatic.com/content/hl-images/2026/09/16/ScreenConnect-headpic.jpg)

Researchers identified a malware toolkit called SCKit in ScreenConnect attacks that compromised at least 288 endpoints across 48 organizations, BleepingComputer reported. It attempts to spread from infected customer devices to support technicians' computers and then into other managed networks.

Huntress believes initial access involved an authentication flaw in RMM+ versions 1.0.31 and 1.0.32, which could accept an empty access key. SCKit separately attempts to exploit a patched file-transfer vulnerability and steal technicians' session cookies. Huntress and Blackpoint Cyber have seen no successful worm-like spread; Blackpoint's testing found the existing ScreenConnect fix blocked execution.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/new-worm-like-sckit-malware-targets-msps-in-screenconnect-attacks/)

---
Canonical: https://techandbusiness.org/newswire/73TqD7tZR97e6knjENw7Du
Published: 2026-11-12T23:31:38.533Z
Story chronology: 2026-11-12T22:53:10.000Z
Retrieved: 2026-11-13T03:04:19.349Z
Publisher: Tech & Business (techandbusiness.org)