A New Malware Variant Exploits ScreenConnect Sessions, Putting MSPs and Their Clients at Risk
A sophisticated malware variant known as SCKit has been discovered to be exploiting screen sharing sessions conducted through SupportConnect, a popular remote support tool used by managed service providers (MSPs) and other organizations. This means that even the most seemingly innocuous online meetings and technical support sessions can potentially become backdoors for malicious actors to gain unauthorized access to sensitive systems and data.
The malware works by manipulating the ScreenConnect client-side application to inject a malicious payload, which is then executed when the user accepts the session request from an attacker. Once inside, SCKit allows hackers to escalate privileges, create new users, modify system settings, and even deploy additional malware payloads. The attackers can also use this access to move laterally within the network, creating opportunities for further data exfiltration or system compromise.
MSPs and their clients are particularly vulnerable to these types of attacks because they often have extensive access to multiple systems and networks across different domains. When a malicious actor gains access through one ScreenConnect session, it can potentially create an active attack path that could be used to breach other connected systems. This highlights the critical importance of robust cybersecurity measures for MSPs and their clients, including regular software updates, strong passwords, and vigilant monitoring of network activity.
The SCKit malware is notable not only for its ability to exploit ScreenConnect sessions but also for its clever use of privilege escalation techniques to create an initial foothold. By creating a “bridge” between two domains or networks, the attackers can bypass traditional security measures and gain deeper access to sensitive systems. This tactic has been used in other high-profile attacks, demonstrating the evolving sophistication of cybercrime tactics.
The rise of SCKit is a stark reminder that even seemingly secure environments are not immune to attack. As MSPs and their clients continue to rely on remote support tools like ScreenConnect, it’s essential for them to remain vigilant about potential security risks. This includes regularly updating software, implementing robust access controls, and conducting thorough risk assessments of all connected systems.
To stay ahead of the latest threats, readers are advised to prioritize regular software updates and patch management, particularly for critical systems and services. Additionally, consider implementing a zero-trust architecture that assumes no user or system is trusted by default, and implement strict access controls to limit lateral movement in case of an attack. By taking proactive steps to secure their networks, organizations can minimize the risk of SCKit-style attacks and protect themselves against the growing threat of cybercrime.
Source: The Hacker News — 2026-11-12