A fast-moving attack campaign has turned a widely used remote-support tool into its own delivery mechanism. Security firm Huntress reports that attackers hijacked cloud-hosted ConnectWise ScreenConnect panels and abused the platform’s own administrative features to push a custom malware toolkit, dubbed SCKit, to at least 288 managed endpoints spread across 48 organizations — with roughly a third of those devices compromised within the first ten minutes alone.

A Startlingly Fast Blast Radius

Huntress says it first detected the activity on November 11, 2026, and that all 288 affected hosts were hit within approximately 90 minutes of the campaign starting. The speed is explained by the method: rather than exploiting a technical flaw in ScreenConnect’s code, the attackers appear to have gained control of legitimate panel access and then used the platform’s own “Run Command” feature — designed to let administrators execute commands across many endpoints simultaneously — to do their dirty work at scale.

Because those commands execute with SYSTEM-level privileges, the highest tier of access on a Windows machine, the attackers didn’t need to chain together a separate privilege-escalation exploit. The malicious commands checked each target for an existing ScreenConnect client, then downloaded a rogue installer to a temp directory and installed it silently in the background.

Possible Entry Point: Third-Party RMM Extensions

ConnectWise, in a public advisory issued November 11, named five third-party extensions that may be connected to the intrusion activity: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. As a precaution, the company disabled these extensions across roughly 400 partner environments. Notably, having one of these extensions installed does not by itself indicate a given organization was compromised — ConnectWise says the extensions expose an API capable of running remote commands, protected by a partner-set passphrase, and the company is still investigating the actual point of entry.

Partners running on-premises ScreenConnect servers rather than the cloud-hosted version need to disable the affected extensions themselves; ConnectWise says it cannot do this centrally for self-hosted deployments. The company states it has found no evidence of a breach in its own infrastructure and no underlying vulnerability in ScreenConnect itself — though the investigation into scope and root cause remains open.

Inside the SCKit Toolkit

SCKit itself is a 16-file package combining PowerShell scripts, batch files, and configuration data, engineered with a notable twist: each infected machine transmits its Windows identifier to an attacker-controlled server, which responds with a decryption key specific to that one machine. This per-device keying scheme means file-hash-based detection is largely ineffective against it, since no two infections necessarily share identical payload files.

Once unlocked, the toolkit installs a second, attacker-controlled ScreenConnect client and configures exclusions in Microsoft Defender to avoid detection. It then drops a tool Huntress has named RelayTrap into a ProgramData directory, alongside a scheduled task called TrapWatch that terminates the legitimate ScreenConnect client and substitutes the attacker’s copy in its place — all while the machine continues to appear normal to its administrator. Huntress researchers also noted that the C# code powering RelayTrap bears hallmarks suggesting it was generated with the help of an AI coding assistant.

A Secondary Target: IT Technicians Themselves

Perhaps the most concerning aspect of SCKit is its apparent secondary objective. Huntress found code specifically designed to lie in wait until a legitimate IT technician connects to an infected device through ScreenConnect. At that point, the malware attempts to push a dropper onto the technician’s own workstation and steal their .aspxauth session cookie — the credential that authenticates an active ScreenConnect session.

Armed with that stolen cookie, the malicious code attempts to reach every other session accessible to that technician and upload a payload into the panel’s Shared Toolbox — potentially using one compromised technician account as a pivot into many more client environments. Huntress says it has not observed this lateral-spread mechanism succeed in the wild; the console-takeover component failed in every host log examined so far. Still, the design illustrates the systemic risk a single compromised RMM credential poses for a managed service provider’s entire client base.

Not the First Time ScreenConnect Has Been Turned Against Its Users

This isn’t an isolated incident for the platform. In September, worm-like rogue ScreenConnect clients were observed passing staged malicious scripts between Windows machines. Around the same period, CISA added a separate ScreenConnect vulnerability — CVE-2026-84869, which scored a near-maximum 9.9 on the CVSS scale — to its Known Exploited Vulnerabilities catalog; that flaw allowed unapproved file transfers during active sessions and has since been patched.

What Defenders Should Do Right Now

Huntress and ConnectWise are giving aligned guidance to affected or potentially affected organizations:

• Do not connect to a suspected-compromised machine through ScreenConnect itself — doing so risks carrying the infection to your own workstation. Use EDR live-response tools, WinRM, or another out-of-band remote access method instead.
• Isolate affected hosts and keep them isolated until cleanup is fully verified — Huntress has observed some machines reinfect after isolation was lifted prematurely.
• Remove the rogue ScreenConnect client, the TrapWatch scheduled task, the RelayTrap directory, and the associated RelayTrapLiteAlert registry Run key.
• Audit Run Command and Toolbox job history for any activity nobody on your team initiated.
• Revoke all active web sessions and rotate credentials — performed from a known-clean device.

Known indicators of compromise associated with the campaign include the domains newnewnew.gotdns[.]org, soxnewwork.homedns[.]org, cdn007-digitaldownloads[.]com, and ns.mo7sen[.]dev, as well as the IP address 185.99.255[.]28 and the ScreenConnect participant display name “Addmin.” ConnectWise says its advisory will be updated as further details of the investigation are confirmed.