ScreenConnect Abuse Lets SCKit Malware Reach Hundreds of Systems Through Trusted IT Tool
Attackers are hijacking ConnectWise’s ScreenConnect to push rogue clients that install SCKit malware, with at least 288 endpoints at 48 organizations targeted, according to Huntress.
A widely used remote‑support product is being turned into an attack channel, exposing how much damage can follow when trusted IT tools are subverted.
Hackers are abusing ConnectWise’s ScreenConnect software to deploy rogue clients that deliver SCKit malware, security firm Huntress reports. At least 288 endpoints across 48 organizations have been targeted in the campaign described.
ScreenConnect is designed to let IT staff or service providers connect into users’ machines for maintenance and troubleshooting. In the activity Huntress tracked, attackers used that same mechanism to push modified clients that, once installed, gave them persistent access via the SCKit toolkit.
ConnectWise has responded by disabling five third‑party extensions associated with the attacks, according to the report. That move is intended to block at least one route the threat actors were using to get their code into ScreenConnect environments.
For affected organizations, the immediate concern is what the SCKit infections enabled. A successful foothold through a remote‑access client can allow intruders to harvest credentials, copy sensitive data, or move deeper into internal networks.
The incident underlines the broader risk that comes with any remote‑management platform: the same features that make it essential for day‑to‑day IT work also make it attractive to attackers, who can blend their traffic into what looks like normal administrative activity.
Defensive priorities now include checking ScreenConnect deployments for unauthorized clients, using the indicators of compromise shared by Huntress and others, reviewing which third‑party extensions are enabled, and tightening controls on who can push new remote‑access software to endpoints.
Further details from ConnectWise on how the attackers operated, and what additional safeguards will be added to ScreenConnect, will help determine whether organizations stick with the tool or start looking for alternatives that can demonstrate stronger built‑in protections.
Sources
- OSINT