SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths

A campaign is targeting ConnectWise ScreenConnect deployments by exploiting a previously patched critical security flaw. The vulnerability, identified as CVE-2026-84869, has a high CVSS score of 9.9. The exploitation of this flaw allows attackers to potentially turn ScreenConnect support sessions into attack paths, particularly for managed service providers. The attacker toolkit was recovered by Blackpoint Cyber's Adversary Pursuit Group, which shared the details of the campaign. The vulnerability is not new, but rather one that has already been patched. The exploitation of this flaw is part of an ongoing campaign.