SCKit Malware: The ScreenConnect Attack That Makes Your IT Provider the Target

SCKit is a worm-like malware toolkit reported on 12 November 2026, deployed in the recent ScreenConnect attacks against managed service providers — the IT companies that remotely run small-business systems (BleepingComputer, 12 November 2026). Its defining trick is the direction it travels: it spreads upstream, from an infected customer machine to the IT technician who connects to it. And it's the second worm-style attack on the MSP toolchain in a week.

What SCKit Is — and Why the Direction of Travel Matters

Most malware you hear about attacks the machine it lands on. SCKit sits on an infected customer device and waits. When the MSP technician connects remotely to fix something, the infection pushes back up the connection to the technician's own computer. From that foothold, the attacker can reach every other client the technician manages.

One infected laptop in one small business becomes a bridge into dozens of others.

That's the same logic we saw in the N-able 4EverAble2Shell zero-day we covered on 12 November (19 Computing blog): don't attack 200 small businesses one at a time — attack the one platform that manages all 200. Two attacks on two different remote-management platforms, days apart, is a pattern rather than a coincidence.

This Updates Our N-able Post — and Answers Its Open Question

On 12 November we wrote that at least 21 systems had been hit through the N-able N-central RMM, and that the uncomfortable detail was 19 of those 21 were running the vendor's latest update. Patching alone did not save them. The honest question we left open was whether that was a one-off.

SCKit answers it. A different vendor, a different tool, the same victim profile, within days. Our earlier advice — "ask your IT provider which RMM they use" — still stands, but the question has changed. It's no longer "have you patched?" It's "what happens when the tool itself is the entry point?"

How the Jump From Your Machine to Your IT Provider Actually Works

ScreenConnect is remote-access software: the technician's PC connects to your machine to fix things, install updates and so on. That connection is a two-way street, and SCKit exploits the return lane.

In plain terms: one infected customer machine waits for the technician to log in, then pushes the infection upstream to the tech's own computer. From the technician's machine, the attacker can reach every other client that tech manages.

This inverts the usual assumption. Most small businesses assume their security depends on their own patching — keep Windows updated, keep the antivirus on, job done. With SCKit, your weakest machine can be the one that burns your IT provider, and through them, every business they look after.

We see the customer-side half of this regularly in the workshop: machines brought in with pop-ups, sluggish behaviour or fans running hot that turn out to have been quietly compromised for weeks before anyone noticed. Those are exactly the machines that give worm-style malware its opening. As we covered in our SSH vulnerability post, warning signs are red flags, not a diagnosis — confirming either way needs proper tools.

Why Remote-Access Tools Are the New Single Point of Failure

An RMM or remote-access tool is, by design, software with keys to every machine in a business. That's what makes it useful — and what makes it the highest-value target in the supply chain.

Concentrating management in one platform concentrates risk. One compromise fans out to every client machine it manages, which is what we said in the N-able post. What SCKit adds is evidence that at least one attacker is now building tooling specifically for that fan-out — a purpose-made worm kit, not opportunistic reuse of generic malware.

The uncomfortable implication for a 5–50 person business: your security posture is now partly your provider's security posture, and theirs is partly yours. You can do everything right on your own machines and still be compromised through the tool your provider uses to manage you — or be the bridge that compromises them.

Patch discipline still matters. But as the N-able numbers showed, 19 of 21 victims were current on updates. When the flaw is in the managing tool, patching is necessary and not sufficient.

Also in the news the same day, and worth a passing mention only: BleepingComputer reported 4,837 compromised GitHub accounts probing 61,764 repositories with secrets-stealing malware — a separate credential-harvesting campaign with no established link to SCKit, but a reminder that stolen logins are circulating at scale right now (BleepingComputer, 12 November 2026). Stolen credentials pair badly with a compromised remote-access foothold.

What to Ask Your IT Provider This Month

If an MSP manages your machines, send them these questions this month. You're not being awkward — you're being the customer these attacks are aimed through.

1. Which remote-access or RMM platform do you use? ScreenConnect, N-able/N-central, or something else? A provider who won't name it is a red flag in itself.
2. What did you change after the 12 November N-able and ScreenConnect news? Not just "we're patched" — what changed about how technicians connect?
3. Do technicians connect to client machines from a dedicated, locked-down machine — or from the same daily-driver PC that browses the web and opens email?
4. How would you know if one of your client machines infected a technician's PC — and how quickly?
5. Is multi-factor authentication enforced on the remote-access platform itself, and are sessions recorded?

As we said in the N-able post: a slow answer is your real risk indicator. A good provider will have answers ready, because they'll have been asked already.

What It Means for Your Own Machines

Your machine doesn't need to be the target to be the bridge. An ordinary infected laptop that a technician connects to is enough — that's the whole SCKit mechanism.

The warning signs we look for in the workshop:

• Pop-ups and browser redirects
• Unexplained slowness
• Fans running hot at idle — in our workshop experience, a classic miner symptom
• Security software that's been silently disabled

If a machine is compromised, patching alone isn't enough. Backdoors need cleaning out, and sometimes a clean Windows reinstall is the safer route — as we covered in the SSH post, a miner is rarely the end of the story.

Backups are the other half. If ransomware rides an MSP compromise into your network, your recovery time is set by your backup, not by your antivirus. If the backup lives on the same compromised network, that's a problem worth fixing before it's tested.

Where 19 Computing Fits In

If a machine on your network is behaving oddly, don't wait for it to be the one that infects your provider. Bring it in for a proper malware check and clean-up — we do virus and spyware removal, clean Windows reinstalls when a backdoor is suspected, and data recovery and backup setup. Collection and delivery across Portsmouth is £10 each way, or drop the machine off at the workshop. Students and NHS staff get our discount, and small businesses get a quote before any work starts.

And if you're not sure what to ask your IT provider, ask us — we're happy to sanity-check their answers across the counter.

Questions people ask