Worm‑Like SCKit Malware Chains MSP Technicians Into ScreenConnect Supply‑Chain Attacks

O que aconteceu

SCKit leverages a vulnerable RMM+ extension to execute commands in ScreenConnect, then attempts to push malicious code back to MSP technicians via a patched CVE‑2026‑84869 flaw, creating a worm‑like infection chain across managed networks.

Por que isso importa para confiança e conformidade

• The attack demonstrates why continuous monitoring of third‑party extensions and robust vendor‑risk oversight are essential for supply‑chain trust and audit readiness.
• Enable continuous monitoring of third‑party extensions to detect authentication bypasses.
• Collect and retain detailed Run Command and Toolbox logs as evidence for audit readiness.

Who is affected

Recommended actions

1. Disable vulnerable RMM+ extensions and verify all ScreenConnect clients are patched to v26.6.5 or later.
2. Implement strict logging and alerting on remote‑command features and conduct a supply‑chain risk review of remote‑access tools.