Attackers used cloud-hosted ScreenConnect panels to install unauthorized remote-access clients and the SCKit toolkit on at least 288 endpoints across 48 organizations, according to Huntress. The activity was observed on November 11 and involved commands pushed to groups of managed devices.
In a late November 11 update, Huntress linked the activity to RMM+, a third-party ScreenConnect extension. Researchers found that versions 1.0.31 and 1.0.32 accepted a blank access key when an administrator had not configured one.
ConnectWise’s November 12 advisory says the initial access method and full scope remain under investigation. The vendor reports no evidence of compromised ConnectWise infrastructure or a vulnerability in ScreenConnect itself. It identified approximately 400 partner environments containing suspect extensions and disabled them wherever it could; that number does not represent confirmed compromises.
SCKit contains mechanisms intended to steal technician session cookies and extend access to other endpoints. Huntress has not observed successful propagation from an infected endpoint through a technician’s workstation to additional devices.
Partners should verify that suspect extensions are disabled, including on premises. ConnectWise advises investigating through separate security tools, avoiding interactive ScreenConnect connections to suspected infected hosts, preserving logs and revoking exposed sessions from a trusted device. Disabling extensions alone may leave endpoint persistence in place.
Image context: The invitation-themed graphic is illustrative. Huntress documented invitation lures in separate ScreenConnect incidents in 2025; this image does not depict the observed SCKit deployment.
