Microsoft has confirmed attackers are abusing ScreenConnect to install unauthorized remote access clients and deploy SCKit, a malicious worm, on devices managed by ConnectWise customers. The toolkit also targets support technicians through hijacked authenticated ScreenConnect sessions, using a victim’s management console to send payloads to additional managed devices, Microsoft says. ConnectWise began reporting unauthorized access to MSPs’ cloud-hosted ScreenConnect instances on November 11.
Microsoft advises defenders to examine both technician workstations and affected customer devices because deleting the unauthorized client leaves the toolkit’s persistence and exposed web sessions unresolved. ConnectWise says the fix for CVE-2026-84869 blocks SCKit’s attempted spread from customer devices to technicians. That protection addresses a different attack path from the server access attackers use to deploy the toolkit.
Read more: Microsoft CEO Satya Nadella warns companies that AI use leaks their most valuable secrets
ScreenConnect lets managed service providers administer customer devices, including running commands remotely without an interactive support connection. In the attacks Microsoft examined, commands sent through the legitimate management instance downloaded and silently installed another ScreenConnect client on a customer device. That client connected to an instance controlled by the attacker, so securing the legitimate console would leave the separate remote access connection intact.
SCKit includes RelayTrap, which replaces the ScreenConnect client on an affected customer device and is designed to deliver a payload when a technician connects. Microsoft describes the propagation sequence as the toolkit’s design, rather than a confirmed chain of infections. Attackers gaining access to either target can administer affected devices remotely, run commands and install additional tools independently of the authorized support instance.
ConnectWise is investigating extension abuse as a possible entry route, but the campaign’s initial access method remains unresolved. Its advisory describes an authentication flaw in RMM+ versions 1.0.31 and 1.0.32 that accepted an empty key when no access key had been configured. Under that condition, an unauthorized caller could send API commands for execution on managed devices without signing into ScreenConnect normally.
Microsoft separately described attackers using ARTEX against financial organizations in October, including deploying remote access malware to retain access and move between systems. Those attacks included malware downloads through curl and netcat, alongside use of the AI framework.
For SCKit deployment, a batch launcher fetches a PowerShell decoder that uses device-specific information to decrypt and unpack the toolkit. SCKit maintains persistence using scheduled tasks and registry Run entries, while staging RelayTrap and scripts for further deployment.
