Hackers Hijack ConnectWise ScreenConnect to Deploy SCKit Malware Across 288 Devices at 48 Organizations

Cybersecuritynews •Guru Baran • November 12, 2026

Attackers have taken over cloud-hosted ScreenConnect panels and used them to push a custom toolkit called SCKit to at least 288 managed devices across 48 organizations. Security firm Huntress first saw the activity on November 11, 2026, and says all 288 hosts were hit within 90 minutes. Huntress reports that one third of […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SCKit Worm Compromises 288 Endpoints via ScreenConnect Exploitation On November 11, 2026, cybersecurity firm Huntress reported that a worm-like toolkit named SCKit exploited vulnerabilities in ConnectWise's ScreenConnect to compromise at least 288 endpoints across 48 organizations. The attackers leveraged a flaw in the RMM+ extension, specifically versions 1.0.31 and 1.0.32, which accepted a blank access key, allowing unauthorized command execution. This exploitation enabled the installation of rogue ScreenConnect clients and the SCKit toolkit, which provides persistent remote access and can intercept session cookies. ConnectWise disabled five third-party extensions as a precaution and is investigating the incident, which has not yet confirmed the initial access vector. The campaign was characterized by rapid deployment, with all affected hosts compromised within 90 minutes. Huntress has shared indicators of compromise (IoCs) and recommended that organizations review their ScreenConnect deployments for suspicious activity. 19 sources 71

Extracted Entities

Hackers Hijack ConnectWise ScreenConnect to Deploy SCKit Malware Across 288 Devices at 48 Organizations

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Tools (1)