Hackers Hijack ConnectWise ScreenConnect to Deploy SCKit Malware Across 288 Devices at 48 Organizations
Hackers exploit ConnectWise ScreenConnect to deploy SCKit malware on 288 devices.
Attackers have compromised cloud-hosted ConnectWise ScreenConnect panels to deploy a custom toolkit named SCKit to at least 288 managed devices across 48 organizations. The activity, first observed on November 11, 2026, saw all affected hosts compromised within approximately 90 minutes. The attackers leveraged the Run command feature with SYSTEM privileges to install SCKit, which includes scripts to establish persistence and add exclusions to Microsoft Defender. ConnectWise has disabled five potentially related extensions and is investigating the incident, stating no signs of their own systems being breached or a flaw in ScreenConnect itself.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ConnectWise?
Get an email when a new story names ConnectWise, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers who gained access to cloud-hosted ConnectWise ScreenConnect management panels were able to abuse the legitimate Run command feature—executed with SYSTEM privileges—to deploy the SCKit malware toolkit across 288 devices in roughly 90 minutes. The root issue was that whoever controlled those panels had effectively unrestricted administrative access to all managed endpoints beneath them, meaning a single point of compromise cascaded instantly across dozens of organizations. SCKit then added Microsoft Defender exclusions to entrench persistence, amplifying the damage. This incident illustrates how remote management tools, while operationally powerful, represent an extremely high-value attack surface: compromising one panel equals compromising every device it manages. Organizations relying on third-party RMM tooling must treat panel credentials and access controls as crown-jewel assets.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — SCKit