ScreenConnect abuse campaign uses rogue clients to push SCKit malware at 48 organizations
Hackers are abusing the ScreenConnect remote‑access platform to install SCKit malware on targeted systems, with at least 288 endpoints at 48 organizations in the crosshairs, according to Huntress. ConnectWise has disabled five third‑party extensions tied to the activity.
Attackers are turning the ScreenConnect remote‑access platform into a delivery channel for stealthy SCKit malware, putting dozens of organizations at risk of deep compromise.
Security company Huntress reports that hackers have been pushing rogue ScreenConnect clients to install SCKit on victim machines. At least 288 endpoints across 48 organizations have been targeted in the activity Huntress has tracked so far, indicating a coordinated campaign rather than isolated misuse.
ScreenConnect, owned by ConnectWise, is widely used by IT teams to reach into remote systems for support and maintenance. That privileged foothold makes any abuse of the platform especially dangerous: once a malicious client or extension is accepted, the attacker can operate with the same breadth of access a trusted technician would have.
In response, ConnectWise has disabled five third‑party extensions linked to the attacks, according to the Huntress account. That step blocks one avenue for further spread but doesn’t automatically clear infections on systems where SCKit has already been deployed.
The organizations affected span 48 separate environments, meaning the blast radius isn’t confined to a single sector or country. Each compromised endpoint represents a potential long‑term access point for whoever controls SCKit, with scope for data theft or disruptive actions that might not be immediately obvious.
The case illustrates how remote‑access and management tools can act as amplifiers for attackers when they’re subverted. Instead of breaking into one machine at a time, intruders look for the software that administrators and service providers already use to reach many machines at once, then ride along.
Huntress has published technical details and indicators of compromise to help defenders look for SCKit and related suspicious ScreenConnect activity. Key questions now are whether more victims emerge beyond the initial 48 organizations, whether similar techniques surface against other remote‑access platforms, and how quickly vendors can harden their ecosystems so that a compromised plugin or client doesn’t translate into broad, hard‑to‑detect access.
Sources
- OSINT