SCKit Malware Weaponizes ScreenConnect Sessions to Compromise MSP Environments
Written by AI from the linked story. Not reviewed by an editor. How this works
The SCKit campaign demonstrates how a single unpatched privilege escalation vulnerability (CVE-2026-84869) in a widely deployed remote support tool can open the door to full MSP compromise. Beyond the patch gap, attackers also hijack authenticated operator sessions, meaning even patched environments remain at risk if session security is weak. The RelayTrap component specifically targets technicians' workstations, turning the trusted support tool into a lateral movement vector. Because MSPs manage many downstream clients, a successful breach here creates a supply-chain-style multiplier effect, amplifying the blast radius far beyond the initial target.
Tactical Insight
Immediate actions
- Apply the available patch for CVE-2026-84869 to all ScreenConnect deployments without delay
- Audit all active ScreenConnect operator sessions and revoke any that cannot be verified as legitimate
- Enforce multi-factor authentication on all operator accounts to reduce session hijacking risk
Long-term improvements
- Implement least-privilege access policies so ScreenConnect operators have only the permissions required for their role
- Isolate MSP management tooling on dedicated, segmented network segments inaccessible from general workstations
- Establish a formal vulnerability management program with SLA-driven patching timelines for internet-facing remote access tools
Detection measures
- Monitor ScreenConnect session logs for anomalous code-push activity or sessions originating from unexpected IP addresses
- Deploy endpoint detection on technician workstations to catch RelayTrap-style implant staging
- Alert on privilege escalation events within ScreenConnect's audit trail in near-real time