SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths

The SCKit malware campaign exploits CVE-2026-84869, a critical improper privilege management flaw in ConnectWise ScreenConnect, to execute unauthorized file transfers and code execution during active remote sessions. The malware uses legitimate ScreenConnect features like Run Command to deploy a malicious MSI installer and PowerShell scripts, enabling persistence and lateral movement by hijacking authenticated technician sessions. A key component, RelayTrap, enables reverse-pivoting to infect technician workstations, leveraging trusted remote support functionality to propagate across managed service provider (MSP) environments without requiring new vulnerabilities once initial access is achieved.

AI-extracted · verify before operational use