thehackernews.com
Nov 12, 2026
SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths
AI-summarised brief · reviewed before publication
Blackpoint Cyber’s Adversary Pursuit Group exposed a campaign that exploits the patched CVE‑2026‑84869 flaw in ConnectWise ScreenConnect. The attackers use a toolkit that hijacks authenticated operator sessions, leveraging legitimate ScreenConnect features to deliver malicious code. The malware, named SCKit, includes RelayTrap, which reverse‑pivots to infect technicians’ workstations via the Run Command function. Once a technician’s session is compromised, the attackers propagate through the same management infrastructure, gaining broader access to customer endpoints.
💡 Why It Matters
- · The attack demonstrates how a single compromised support session can become a pivot point for widespread lateral movement, underscoring the need for strict session isolation and monitoring in remote‑access tools.
