# Hackers Turn ScreenConnect into SCKit Malware Delivery Channel for 48 Organizations

*Thursday, November 12, 2026 at 6:17 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-11-12T06:17:38.153Z (40m ago)
**Category**: cyber | **Region**: Global
**Importance**: 8/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/23236.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: Attackers are abusing ScreenConnect remote‑access software to push rogue clients that deliver SCKit malware to at least 288 endpoints across 48 organizations, according to security firm Huntress, prompting ConnectWise to disable five third‑party extensions.

A new campaign exploiting popular remote‑access tool ScreenConnect has exposed dozens of organizations to compromise, with attackers using it to install SCKit malware on hundreds of systems.

Security company Huntress reports that hackers deployed rogue ScreenConnect clients to target at least 288 endpoints spread across 48 victim organizations. In response, ScreenConnect developer ConnectWise disabled five third‑party extensions linked to the activity. That step cuts off part of the attackers’ path, but the underlying problem remains: software that grants deep, legitimate access to computers can become a powerful attack vector when misused.

ScreenConnect is widely used by IT teams to manage machines remotely, install updates, and troubleshoot problems. Those same capabilities appeal to intruders. Once they control a ScreenConnect client, they can move through a network, run commands, and plant additional tools while their activity resembles ordinary administrative work.

In this operation, the final payload is SCKit, a piece of malware that provides persistent, covert access to infected devices. Public details on its inner workings are limited in the cited reporting, but malware of this type generally allows attackers to maintain a foothold, collect credentials, and stage further attacks inside a network.

If service providers are among the 48 affected organizations, the potential reach of the compromise widens. A single hacked IT provider can give attackers indirect access to many downstream customers, a pattern seen in earlier incidents involving remote‑management platforms.

For defenders, the incident reinforces the need to monitor and tightly control remote‑access tools. That includes tracking who installs and uses clients like ScreenConnect, enforcing strong authentication, and logging administrator activity so unusual behavior stands out.

Key developments to watch include whether other security firms validate or expand on Huntress’s findings, whether more ScreenConnect components are implicated, and whether any of the victim organizations publicly disclose breaches or data loss tied to SCKit. Regulatory attention to remote‑management vendors and changes in how companies handle privileged access would show how seriously this warning is being taken.