Active ScreenConnect attacks breach MSPs and impact dozens of organizations

# Active ScreenConnect attacks breach MSPs and impact dozens of organizations

https://gcdradar.vercel.app/incidents/active-screenconnect-attacks-breach-msps-and-impact-dozens-o · AIR-2026-1910 · live

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed real-world exploitation and attacks against multiple organizations.
- Fix status: No fix needed
- First reported: 2026-11-11
- AI role: No AI role
- Products: ScreenConnect
- CVE ids: CVE-2026-84869

## Summary

Threat actors are actively exploiting ConnectWise ScreenConnect to deploy unauthorized remote-access software across managed service provider customer environments. ConnectWise is currently investigating the ongoing campaign.

## What to do

Apply the patch for CVE‑2026‑84869 to all ScreenConnect installations.

## Latest updates

- 2026-11-12: New worm-like malware toolkit named SCKit identified spreading across MSP and customer environments in ongoing attacks (https://bleepingcomputer.com/news/security/new-worm-like-sckit-malware-targets-msps-in-screenconnect-attacks)
- 2026-11-12: Report indicates the exploited CVE‑2026‑84869 flaw has been patched, providing a fix for the ScreenConnect campaign. (https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html)
- 2026-11-12: Attackers exploited a vulnerability in a legitimate extension to bypass authentication. (https://securityweek.com/hackers-deploy-malware-in-fresh-screenconnect-campaign)
- 2026-11-12: Vendor disabled five third-party extensions and reported no evidence of software vulnerabilities. (https://thehackernews.com/2026/11/screenconnect-attacks-target-at-least.html)
- 2026-11-11: Active ScreenConnect attacks breach MSPs, impact dozens of organizations (https://bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations)

## Sources

- 2026-11-11 BleepingComputer: Active ScreenConnect attacks breach MSPs, impact dozens of organizations https://bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations
- 2026-11-12 The Hacker News: ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients https://thehackernews.com/2026/11/screenconnect-attacks-target-at-least.html
- 2026-11-12 SecurityWeek: Hackers Deploy Malware in Fresh ScreenConnect Campaign https://securityweek.com/hackers-deploy-malware-in-fresh-screenconnect-campaign
- 2026-11-12 The Hacker News: SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html
- 2026-11-12 BleepingComputer: New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks https://bleepingcomputer.com/news/security/new-worm-like-sckit-malware-targets-msps-in-screenconnect-attacks
- 2026-11-13 Microsoft Security: SCKit abuses ScreenConnect to deploy remote access and target technician sessions https://microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.