SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints

The SCKit worm exploited cloud-hosted ScreenConnect panels to deploy rogue clients and a toolkit across hundreds of endpoints in multiple organizations. It spreads by stealing session cookies to move from infected endpoints to technician workstations and then laterally to other endpoints. The toolkit uses encrypted payloads keyed by system UUIDs to install persistence mechanisms and attempt console takeover. Although endpoint infections were successful, technician workstation compromises failed in observed cases. ConnectWise disabled some third-party extensions as a precaution but has not identified the initial access vector.

• DarkCore: A Data-Theft RAT With a Session-Hijacking BrowserMalware2026-10-27
• Phishing Abuses RMM Tools for Persistent AccessMalware2026-09-29
• RMM Tools Being Distributed Through Phishing Attacks (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able)Malware2026-10-08
• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMsMalware2026-10-07
• Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like ActivityMalware2026-09-03