Threats tagged 'toolboxrelayuploader'

SCKit is a malicious toolkit discovered in November 2026 that abuses ScreenConnect's remote management functionality. It uses a Guest-to-Host file execution technique exploiting CVE-2026-84869 to compromise technicians. The toolkit's RelayTrap component replaces legitimate ScreenConnect Guest processes to send malicious payloads to technicians and attempts to steal .ASPXAUTH cookies to reuse management permissions for lateral command distribution. Testing shows that patched ScreenConnect Host clients block this reverse execution attack. The campaign mainly targets managed service provider (MSP) environments where technician sessions are compromised.