ScreenConnect · Exploitation reported

ScreenConnect patches flaw exploited by SCKit malware

Nov 12, 2026 · 1 min read

SCKit malware exploits a patched ScreenConnect flaw and targets IT support technicians. It attempts to hijack technician sessions to spread across managed service provider customer networks. The patch blocks exploitation of the flaw but does not prevent session hijacking.

By HIFY Radar newsroom Updated 11/12/2026 10:11 AM Get this every day →← Back to the feed 2 sources

CriticalVulnerabilityExploitation reportedPatched

In 30 seconds

Alleged

The latest supplied update alleges that SCKit malware is targeting ScreenConnect IT support technicians through a patched, 9.9-rated flaw. The reported goal is to hijack technician sessions and reach customer networks managed by service providers. The same update warns that patching blocks the cited exploit but does not, by itself, prevent session hijacking.

What happened

Alleged

SecurityWeek reported that attackers exploited a vulnerability in a legitimate extension to bypass ScreenConnect authentication. The supplied excerpt does not name the extension, vulnerability identifier or affected versions.

Alleged

A later post from The Hacker News attributed the activity to SCKit and said the attackers were now focusing on support technicians, whose privileged sessions could provide a path into multiple managed customer environments.

Why it matters

Inferred

Technician access is especially sensitive because one compromised support session may expose systems beyond the original ScreenConnect server. That makes the reported session-hijacking path a potential multiplier for managed service providers, although the supplied evidence does not show how many environments were actually reached.

What to do

Inferred

ScreenConnect operators should apply the relevant patch, but should not treat patching as proof that the incident is contained. Because the reported residual risk involves technician sessions, teams should also investigate suspicious active sessions and unauthorized access rather than relying only on the software update.

Confirmed and still uncertain

Observed

The supplied reports support a claimed authentication bypass, malware deployment and attempted technician-session hijacking. They do not provide a CVE, technical indicators, victim count, geographic scope, attacker identity or independent confirmation that customer networks were successfully compromised.

What people are saying

Alleged

SecurityWeek says attackers abused a vulnerability in a legitimate extension to bypass authentication. The Hacker News says SCKit exploits a patched flaw and attempts to hijack technician sessions, while emphasizing that the patch stops the exploit but not the separate hijacking risk.

Evolution

Observed

The first supplied report described a fresh ScreenConnect campaign centered on authentication bypass through a legitimate extension. A later update added a malware name, SCKit, identified technicians as the target and framed session hijacking as the remaining concern after patching.

Reach

Observed

2 independent groups, 2 updates, and 4 engagements.

Technical detail

Alleged

The reported chain begins with exploitation of a flaw in a legitimate extension to bypass ScreenConnect authentication. The later account says the vulnerability carries a 9.9 severity rating and has been patched, but distinguishes that initial exploit from subsequent technician-session hijacking, which it says the patch does not prevent.

Sources and evidence

Observed

The evidence consists of a short SecurityWeek RSS excerpt, a Hacker News feed entry without an included article body, and a Hacker News social post containing the detailed SCKit claims. It establishes what the outlets reported, but does not include vendor advisories, forensic artifacts or victim statements that independently verify the full campaign narrative.