A worm-like toolkit named SCKit has compromised at least 288 managed endpoints across 48 organizations. The compromise occurred through abused ConnectWise ScreenConnect panels, according to multiple sources.
The attack was first detected on November 11, 2026, around 5:47 p.m. UTC. Huntress observed that all 288 hosts were compromised within about 90 minutes, with approximately one third affected in the first 10 minutes.
Attackers exploited vulnerabilities in RMM+ extensions, specifically versions 1.0.31 and 1.0.32, which allowed them to bypass authentication by accepting blank access keys. This exploitation has been confirmed by Huntress.
The SCKit toolkit establishes persistent remote access and creates a relay trap for intercepting session cookies. The infection path involves deploying rogue ScreenConnect clients across endpoints and potentially spreading to technician workstations.
ConnectWise has disabled five third-party extensions in partner environments as a precautionary measure. However, ConnectWise stated there is no evidence of a compromise of its infrastructure or a vulnerability in the ScreenConnect software itself.
Defenders are advised to avoid connecting to suspect machines through ScreenConnect to prevent spreading malware. The exact method of initial access remains unclear, and no new vulnerabilities have been identified.