Malware tries to turn tech support into a trap after 288 endpoints are compromised
Text
SCKit targets connecting technicians, but researchers have not observed that spreading route succeed. Updating a cloud console does not update local clients.
SCKit aims to make the technician its next victim. Huntress identified unauthorized remote-access software on at least 288 endpoints across 48 organizations within 90 minutes on November 11.
ScreenConnect normally enables remote support. Huntress linked a possible entry route to RMM+ extensions accepting blank keys when no key was configured. The vendor is still investigating initial access.
The toolkit attempts to infect connecting technicians and steal sessions to reach more devices. Huntress has not seen that chain succeed. ConnectWise says client version 26.6.5 and later block this reverse-spread technique.
Its November 12 update stresses that cloud-console upgrades do not update technicians' clients automatically. Organizations should check clients, keep implicated extensions disabled and investigate using separate security tools. Roughly 400 environments had extensions disabled as a precaution, not 400 confirmed compromises.
Source times: Huntress first published November 12, 2026, 10:00 Beijing / November 11, 9:00 PM EST, updated November 12, 12:34 Beijing / November 11, 11:34 PM EST; ConnectWise advisory first published November 12, 06:45 Beijing / November 11, 5:45 PM EST, updated November 13, 02:45 Beijing / November 12, 1:45 PM EST.
Share this article
What do you think of this story?
Anonymous feedback, up to 5 reactions per article.
Anonymous comments
Share your thoughts without signing in.
Discuss the technology and the story. Hate, politics and war, threats, abuse, personal accusations, sexual content, ads, links and personal information are not allowed.
No comments yet. Be the first to share.