ConnectWise ScreenConnect: Critical SCKit Malware Campaign Exploits CVE-2026-84869

For businesses utilizing ConnectWise ScreenConnect, there's a critical threat demanding immediate attention: the SCKit malware campaign. This sophisticated attack actively exploits CVE-2026-84869, a severe vulnerability with a CVSS score of 9.9, in the ScreenConnect client. Your most crucial action today is to update your ConnectWise ScreenConnect client installations to version 26.6.5 or later, as this patch effectively prevents the exploit's payload execution. However, further steps are essential to protect your operator sessions from SCKit's advanced capabilities.

What Happened, With Dates

An active campaign targets ConnectWise ScreenConnect clients, exploiting a critical flaw, CVE-2026-84869, with a CVSS score of 9.9. This improper privilege management and missing authorization vulnerability allows unauthorized file transfer and execution during active remote sessions without host confirmation. It was officially published on 2026-09-08.

Security researchers confirmed the SCKit attacker toolkit exploits CVE-2026-84869. Crucially, testing shows a fully patched ScreenConnect client successfully *prevents* the exploit's payload execution.

The SCKit malware, however, is sophisticated. Even with patching, it can hijack authenticated operator sessions and use legitimate ScreenConnect features to push malicious code. Its "RelayTrap" functionality aims to infect technician workstations that investigate suspicious activity, abusing trusted functionality once an attacker has a valid session.

The attack sequence involves checking for ScreenConnect, then downloading "sc.msi" which drops "sckit-run.bat." This script contacts "ns.mo7sen[.]dev" to fetch "sckit-decoder.ps1," ultimately deploying SCKit components. These include "SilentForceInstall-WithUninstall.ps1" for persistent access via unauthorized ScreenConnect Access clients, and code for RelayTrap.

Given its severity and active exploitation, CISA added CVE-2026-84869 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-09-11, setting a federal agency fix deadline of 2026-09-14. This underscores the urgency for immediate mitigation.

Who is Affected and How to Check

ConnectWise ScreenConnect **client installations** are primarily affected by CVE-2026-84869; ScreenConnect servers are not directly impacted by this specific flaw. The vulnerability allows files to be transferred and executed without authorization or host confirmation in certain circumstances.

You are vulnerable if your organization uses ScreenConnect and has not updated clients to version **26.6.5 or later**. All versions prior to 26.6.5 are affected. The SCKit malware first leverages this client-side vulnerability, then targets authenticated operator sessions. This means a compromised operator session, even on a patched system, can still lead to malware distribution.

The attack ultimately targets technician workstations. If a technician connects to an infected endpoint, SCKit attempts to infect their machine, aiming to steal authenticated ScreenConnect browser sessions and expand the intrusion to other customer environments the technician manages.

To check your exposure, verify your ConnectWise ScreenConnect client versions across all endpoints. Any client older than 26.6.5 is vulnerable to the initial exploit. Also, rigorously examine technician workstation security and implement robust session management practices for all administrative access.

The affected versions are:

What to Do Now

Your most critical action is to **patch your ConnectWise ScreenConnect client installations immediately**. Upgrading to version **26.6.5 or later** successfully prevents the exploit's payload execution for CVE-2026-84869. Prioritize this update across all managed endpoints, adhering to CISA's guidance for timely security updates.

Crucially, strengthen your operator session protections. Even patched systems are at risk from SCKit if operator sessions are compromised. Implement tighter session validation and enforce additional authentication for high-impact administrative actions to counter session hijacking.

Proactively investigate any rogue ScreenConnect Access installations on endpoints. These unauthorized clients are a key persistence mechanism for SCKit. Their presence indicates a likely compromise.

Review your ScreenConnect administrative command history for unusual commands, especially those for checking installations, downloading MSI files, or executing scripts via "Run Command."

Implement rigorous security for technician workstations. These high-value targets require robust defenses, including endpoint detection and response (EDR) and strict application whitelisting, as they often hold administrative access to multiple environments.

Secure browser sessions used by technicians for ScreenConnect management. Enforce strong, unique passwords and consider isolated browsing environments for administrative tasks.

While ConnectWise disabled five third-party extensions, security researchers found no technical link to SCKit. Still, always exercise caution with third-party integrations.

For assistance with patch management, security hardening, or establishing robust incident response plans, VITI Security offers managed IT services and cybersecurity solutions.

How to Spot Exploitation

Detecting SCKit requires vigilance across endpoints, network traffic, and administrator workstations. The attack is designed to be stealthy, but leaves traces.

**Unauthorized ScreenConnect Access Clients:** A clear indicator is the presence of unapproved ScreenConnect Access clients, installed by SCKit for persistence. Audit your endpoints regularly for these.

**Malicious Files:** Search for "sc.msi," "sckit-run.bat," "sckit-decoder.ps1," and "SilentForceInstall-WithUninstall.ps1" on your systems. Their presence is a strong compromise indicator.

**Network Communications:** Monitor for connections to "ns.mo7sen[.]dev." This domain is used by the dropper script to fetch components. Any connection to it is a critical red flag.

**Unusual Command Execution:** Review ScreenConnect command history for suspicious commands, especially those for checking installations, downloading MSI files, or executing scripts via "Run Command."

**Technician Workstation Compromise:** If a technician's workstation is compromised, look for unusual network activity, attempts to recover browser session data (.ASPXAUTH cookies), or unexpected propagation of commands to other managed endpoints.

**Behavioral Anomalies:** Be alert for new, unexpected processes running under the `NT AUTHORITY\SYSTEM` context or interference with existing ScreenConnect Guest sessions beyond legitimate support.

If you suspect an active compromise or require expert assistance in hunting for these indicators, VITI Security offers incident response services to help you investigate and remediate.

What it Means for Small and Mid-Size Businesses

This ConnectWise ScreenConnect vulnerability and SCKit malware campaign pose a critical threat to SMBs, especially those relying on remote access or Managed Service Providers (MSPs). A CVSS score of 9.9 demands immediate, decisive action.

**Patching is paramount:** Immediately update your ConnectWise ScreenConnect clients to version 26.6.5 or later. This is your primary defense against CVE-2026-84869 exploitation and prevents the initial attack vector.

However, patching isn't enough. SCKit's ability to hijack operator sessions and turn technician workstations into pivot points highlights a significant supply chain risk. If a technician's machine (whether from your internal IT or your MSP's) is compromised, attackers can move laterally across all client environments that technician manages. This is a severe risk for data breach and regulatory compliance like SOC 2, ISO 27001, GDPR, or DPDP Act.

Extend your security focus to administrative processes and personnel. This means implementing multi-factor authentication for all administrative access, enforcing least privilege, and segmenting networks to limit the blast radius of a potential compromise.

Regular security audits and vulnerability assessments, such as those provided by VAPT services, can help identify weaknesses in your remote access infrastructure before they are exploited. Furthermore, having a robust incident response plan is critical to minimize damage if an attack does occur.

If you use an MSP, open a dialogue with your provider about their security posture regarding remote access tools like ConnectWise ScreenConnect. Ensure they adhere to best practices for patching, session management, and technician workstation security. Your business's security is intrinsically linked to theirs.

Sources