GajShield Threat Advisory — SCKit Worm-Like Toolkit Abusing ConnectWise ScreenConnect

Severity: Critical | Priority: 1

SCKit is a newly discovered toolkit that turns ConnectWise ScreenConnect, a remote-support platform widely used by managed service providers (MSPs) and IT teams, into a way to spread through the organisations those providers support. On 11 November 2026, an attacker used the “Run Command” feature of cloud-hosted ScreenConnect panels to run scripts as SYSTEM on groups of managed computers at once. Within 90 minutes, 288 endpoints across 48 organisations had a second, attacker-controlled ScreenConnect client installed alongside the legitimate one. A third of them were hit in the first ten minutes. ConnectWise disabled five third-party ScreenConnect extensions across about 400 partner environments as a precaution. Researchers have since linked the activity to versions of one extension that accepted a blank access key. How the attacker first got in is still being investigated.

On each machine, SCKit:

• stops the legitimate ScreenConnect service
• adds Microsoft Defender exclusions
• creates a scheduled task named TrapWatch
• installs its own rogue client, which reports to the attacker’s server

It then sets a trap for the IT staff who support that machine. When a technician connects, a component called RelayTrap tries to push a file back to the technician’s own computer, abusing a ScreenConnect file-transfer flaw. Other scripts try to steal the technician’s ScreenConnect web session cookie and reuse it to send commands to more of the provider’s customers. Researchers did not see this second stage succeed, and a fully patched technician client did not run the transferred file. The design, however, aims to spread from one customer to the next through the provider. The code appears to have been written with the help of an AI model.

Organisations that use ScreenConnect, directly or through an MSP, should take these steps:

• Do not connect to suspected computers through ScreenConnect. Use your endpoint security tool’s remote response feature or another out-of-band method instead.
• Update ScreenConnect host clients and agents to version 26.6.5.9742 or later.
• Remove the rogue software. Isolate affected machines, then remove the rogue ScreenConnect client, the TrapWatch scheduled task, the C:\ProgramData\RelayTrap folder, the RelayTrapLiteAlert startup entry and any unexpected Defender exclusions.
• Audit the panel. Review Run Command, Toolbox and session history for commands nobody can account for, and check every installed ScreenConnect client against your approved servers.
• Secure accounts. From a clean device, end all ScreenConnect and identity-provider sessions, rotate technician passwords, and keep the disabled third-party extensions switched off.