A new malware campaign targeting Managed Service Providers (MSPs) highlights a serious cybersecurity concern: the trusted remote connections used to support and protect customer systems can themselves become targets for attackers.

Researchers investigating attacks involving ConnectWise ScreenConnect identified a malicious toolkit called SCKit, deployed across at least 288 endpoints belonging to 48 organisations within just 90 minutes.

The attackers used compromised remote management environments to install unauthorised ScreenConnect clients, establishing persistent access to customer systems.

However, what makes SCKit particularly concerning is its intended ability to spread beyond the initially compromised computers.

The malware was designed to turn an infected customer device into a trap for the IT technician connecting to it. By exploiting a vulnerability in the remote support client, attackers attempted to compromise the technician's workstation, steal authenticated sessions and use the technician's existing privileges to access additional customer environments.

Although researchers have not observed this worm-like propagation succeeding, the attack demonstrates how trusted IT support relationships can potentially be exploited to compromise multiple organisations.

For enterprises, this raises an important question: Are remote support connections automatically trusted simply because they originate from an authorised IT service provider?

MSPs and IT administrators often possess extensive access privileges across customer networks. A compromise of these privileged connections could allow attackers to move between otherwise independent business environments.

This incident reinforces the importance of Zero Trust access, strict privilege management, endpoint protection, secure remote administration and continuous behavioural monitoring.

Organisations should monitor unusual remote commands, unexpected software installations, suspicious session activity and attempts to access systems outside normal administrative patterns.

Equally important is ensuring that third-party extensions and integrations cannot bypass established authentication and security controls.

The cybersecurity lesson is clear: Trusting the identity of an IT administrator is not enough. Every remote session and privileged action must be continuously verified.

Because the next cyberattack may not come through an unknown outsider. It may arrive through the same trusted connection used to maintain and protect your systems.

A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians' computers and compromise additional managed networks. [...]

Source: New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks via Bleeping Computer — published 12 Nov 2026.