Search: CVE-2026-84869

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

The SCKit worm exploited cloud-hosted ScreenConnect panels to deploy rogue clients and a toolkit across hundreds of endpoints in multiple organizations. It spreads by stealing session cookies to move from infected endpoints to technician workstations and then laterally to other endpoints. The toolkit uses encrypted payloads keyed by system UUIDs to install persistence mechanisms and attempt console takeover. Although endpoint infections were successful, technician workstation compromises failed in observed cases. ConnectWise disabled some third-party extensions as a precaution but has not identified the initial access vector.

Threat actors are abusing Microsoft Teams' external chat feature to conduct social engineering attacks and deliver malicious payloads. They impersonate IT support using throwaway Microsoft 365 tenants with deceptive display names to bypass warnings. Attacks often start with email bombing, followed by Teams contact offering help, then use legitimate remote access tools to gain control quickly. This technique exploits collaboration features rather than software vulnerabilities.