ScreenConnect Abuse Exposes 48 Organizations to SCKit Malware in New Supply-Chain-Style Cyber Threat
Hackers are hijacking the ScreenConnect remote-access platform to push rogue clients that deploy SCKit malware, targeting at least 288 endpoints across 48 organizations. The campaign turns a trusted IT tool into a delivery vehicle for intrusion, forcing companies to question the software that underpins their own support operations.
A tool meant to help IT teams fix problems remotely is being turned into an attack vector. Security firm Huntress reports that hackers are abusing ScreenConnect, a popular remote-access product, to install rogue clients that deliver the SCKit malware across corporate networks.
According to the disclosure, at least 288 endpoints in 48 organizations have been targeted so far. Instead of breaking in through obvious phishing emails or exposed servers, the attackers are piggybacking on a platform that many companies allow deep access into their systems by design. Once the malicious ScreenConnect client is in place, SCKit can be deployed, giving intruders a foothold that looks, on the surface, like routine remote support.
For system administrators and small IT teams, that’s a troubling inversion of trust. ScreenConnect, developed by ConnectWise, is widely used by managed service providers (MSPs) and in-house helpdesks to troubleshoot employees’ machines, configure software, and monitor systems. Those same privileges make it a potent weapon in the wrong hands. Huntress’ findings suggest that the attackers either compromised existing ScreenConnect instances or abused extension mechanisms to slip in their own code.
In response, ConnectWise has disabled five third-party extensions linked to the abuse, a sign that the company sees the attack as serious enough to justify cutting off functionality for all users while the investigation proceeds. That move will disrupt some legitimate workflows but may be necessary to stop further spread, especially if the attackers were exploiting vulnerabilities or lax controls in how extensions are loaded and trusted.
SCKit itself is described as malware, though the reports do not yet spell out its full capabilities. Based on the context, it is likely used to establish persistent access, exfiltrate data, or stage follow-on attacks such as ransomware or credential theft. Because it rides in on an ostensibly legitimate remote-support session, traditional security tools and busy administrators might initially overlook its presence.
The human and operational stakes are immediate. The 48 affected organizations are not named, but any entity relying on ScreenConnect—from hospitals and schools to manufacturers and local governments—faces the same basic risk: the very tools built to keep systems running may be quietly opening the door to compromise. Incident response teams now have to examine remote-access logs and configurations with the same suspicion they historically reserved for unknown executables or suspicious emails.
Strategically, the incident fits a broader pattern of attackers exploiting supply-chain relationships and trusted platforms rather than battering against hardened perimeters. By infiltrating an IT management tool, a single successful technique can be replicated across dozens of victims, each of which has effectively pre-approved the attacker’s path of entry.
It’s a reminder that cybersecurity is now as much about governance of third-party tools as it is about firewalls and antivirus software. Organizations that outsource IT operations or lean heavily on remote-management platforms inherit not just convenience but also the blast radius when those platforms are abused.
Signals to monitor include detailed technical reports from Huntress and other security researchers on how exactly the ScreenConnect abuse worked, any patches or architectural changes ConnectWise rolls out, and whether additional victims surface beyond the 48 already identified. Regulatory attention—from data protection authorities or sector-specific watchdogs—could follow if it emerges that sensitive personal or operational data was compromised in the course of these attacks.
Sources
- OSINT