The security landscape for Managed Service Providers (MSPs) faces a new peril: the SCKit malware is exploiting ScreenConnect support sessions to expand attacks into technician workstations. The toolkit targets a critical, already patched vulnerability but also leverages legitimate session hijacking and built-in management features to maintain persistent, wide-reaching access.
How the Attack Works
The core exploit used by SCKit is CVE-2026-84869 (CVSS 9.9), a flaw in ConnectWise ScreenConnect involving missing authorization and improper privilege management. It allows attackers to transfer files and run code via active sessions without host confirmation. Fully patched ScreenConnect clients are immune to this exploit. However, the patch doesn’t cover risks arising when an attacker already compromises an authenticated operator session.
SCKit includes a module dubbed RelayTrap, designed to infect technician workstations that are investigating a compromised managed endpoint. Using ScreenConnect’s Run Command feature, SCKit drops an MSI installer if ScreenConnect is present, then triggers a batch script (“sckit-run.bat”) and follows up with a PowerShell decoder. This chain installs unauthorized ScreenConnect Access clients, includes scripts and C# modules to disrupt guest sessions, and replaces the legitimate ScreenConnect Guest component to relay malware back through guest connections.
Crossing the Perimeter: From Endpoints to Technicians
Once the toolkit has infiltrated a technician’s machine, it pivots. It searches for authenticated ScreenConnect sessions—cookies or in-process memory—allowing malware to spread to other endpoints under that technician’s control. Because commands are executed under the NT AUTHORITY\SYSTEM context on existing agents, attackers can deploy software without triggering additional authentication steps on each machine. The unauthorized Access clients ensure that even after remediation, attackers retain access.
Although this behavior targets technicians because of their broader access, it also underscores an important distinction: patching the known vulnerability prevents the CVE-2026-84869 exploit, but it does not stop attackers from abusing valid sessions. To defend effectively, both endpoint protection and session security are necessary.
Response and Mitigation
ConnectWise has disabled five third-party extensions in partner ecosystems as a precaution, though no direct connection between those and SCKit has been confirmed. To date, there is no evidence that SCKit has successfully bypassed patched clients or achieved confirmed propagation to technician workstations.
CVE-2026-84869 was added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog on September 11, 2026, requiring federal agencies to apply the patch by September 14. Organizations using ScreenConnect are urged to update immediately and ensure that all clients are fully patched.
Experts recommend implementing stronger protections around technician sessions: adding tighter session validation, requiring multi-factor authentication for high-privilege actions, and closely monitoring technician workstations and administrative command histories.
What this means: The SCKit campaign marks a shift from pure vulnerability exploitation to abuse of trust and authenticated access. If attackers compromise a technician’s session, they can pivot into environments with far greater privileges. Organizations and MSPs must treat operator session security with the same urgency as patching known flaws.
