ScreenConnect abused by SCKit: when your IT provider’s remote access tool opens a second door
Your IT provider most likely connects to your computers with a remote access tool. It’s convenient: they fix a problem without travelling. This week, that tool became the way in for an attack. Since November 11, 2026, attackers have been using ScreenConnect, the ConnectWise tool widely used by managed service providers, to install a second remote access program on their clients’ computers, followed by a malicious toolkit called SCKit.
The key point for a small business: the victim didn’t have to click anything. The commands came through their provider’s legitimate support channel. Here’s what happened, how to spot the traces, and the five questions to ask your IT provider on Monday.
ScreenConnect and SCKit: what happened in three days
According to the ConnectWise advisory cited by Microsoft, versions 1.0.31 and 1.0.32 of the third-party RMM+ extension accepted an empty access key when nobody had configured one. Someone could then send commands to managed computers without signing in to the console normally. A CVE (CVE-2026-127063) has been assigned to this extension; no fixed version has been announced, and the current mitigation is to disable it.
The command received by client computers
Microsoft published the shape of the commands that were sent. In short, simplified and annotated:
Why a client can be hit without doing anything
Each link below is a legitimate tool or a forgotten setting. It’s the chain that creates the attack:
1
A forgotten extension
RMM+ is installed on the provider’s ScreenConnect server for a project, then left in place with no key configured.
2
A "legitimate" command
The attacker sends a command through ScreenConnect’s Run feature. The client computer runs it as if it came from the provider.
3
A second way in
A ScreenConnect client connected to the attacker is installed, along with the SCKit toolkit.
4
A trap for the technician
The RelayTrap component waits for a technician to connect to the infected computer and tries to pass the toolkit on to them.
5
Session cookies
SCKit looks for console sign-in cookies in Chrome, Edge and Opera, to reach other clients of the same provider.
Microsoft says this jump from client computer to technician is built into the toolkit’s code, without confirming it has succeeded. ConnectWise says technician clients on version 26.6.5 or later block the technique (fix for CVE-2026-84869, released September 8, 2026). We described this type of risk in our article on the N-able N-central Able2Shell vulnerability.
The signs to check on your computers
🖥️
Two ScreenConnect clients on the same computer
In installed programs or Windows services: one more "ScreenConnect Client" than expected, or one tied to an unknown address.
⏰
A scheduled task named "TrapWatch"
In Task Scheduler; Microsoft lists it among SCKit’s traces.
📁
A C:\ProgramData\RelayTrap folder
Or "sckit" files in the Windows temp folder.
🛡️
New Microsoft Defender exclusions
Folders excluded from scanning that nobody in your company asked for.
📜
Commands nobody ran
In the ScreenConnect console’s Run Command and Toolbox history: for your provider to check.
🍪
Unexplained open sessions
Sign-ins to your cloud accounts from an unusual device or country.
🚫 If you find a trace: don’t let the technician connect through ScreenConnect
ConnectWise and Microsoft recommend investigating through another channel. A ScreenConnect session to an infected computer can expose the technician’s workstation. Isolate the device from the network, then revoke sessions and change passwords from a clean device: changing the password doesn’t always close sessions that are already open, as we explained in our article on Microsoft 365 session theft.
5 questions to ask your IT provider on Monday
📄 Email to your IT provider: ScreenConnect and SCKit
A good answer is specific, dated and in writing. A vague answer ("we’re on it") deserves a follow-up. To go further, our decision tree on abused remote access tools helps you sort out each situation.
How NeoTech can help
For our managed IT services clients, we keep an inventory of the remote access tools authorized on each computer, remove extensions and integrations that are no longer used, and provide automated 24/7 monitoring with on-call technician intervention when an unknown remote access program appears or a session behaves abnormally. If you work with another provider, we can check your computers independently.
Book your free cyber check
In 30 minutes, we check which remote access tools are installed on your computers, whether they’re all expected, and how your IT provider protects its console.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- Microsoft Security Blog — SCKit abuses ScreenConnect to deploy remote access and target technician sessions (Nov. 13, 2026)
- ConnectWise — ScreenConnect security advisory: precautionary extension disabling and partner guidance
- ConnectWise — CVE-2026-127063 (third-party RMM+ extension)
- Cybersecurity Dive — ConnectWise disables third-party extensions as it probes cyberattack targeting ScreenConnect users (Nov. 12, 2026)
- NHS England Digital — ConnectWise Releases Security Advisory Following Unauthorised Access to ScreenConnect Environments
Photo: Tima Miroshnichenko, Pexels (Pexels licence).