# SZB-498d5eb864: SCKit malware reported in ScreenConnect attacks targeting MSPs A BleepingComputer Bluesky post says a worm-like malware toolkit named SCKit was deployed in recent ScreenConnect attacks on managed service providers. - Type: Breach - Status: Corroborated - Vendor: ScreenConnect - Product: ScreenConnect - Disclosed: 2026-11-12 22:53 UTC - Data taken: 288 records - Sources: 1 distinct - First seen by cve.now: 2026-11-12 22:54 UTC · Updated: 2026-11-12 22:55 UTC > No statement or filing from ScreenConnect has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it. Written by a model from the sources below. Verify against them. ## Summary The post gives no further details, such as affected systems or how the attackers got in. ## What to do - Read the full BleepingComputer report for indicators of compromise. - Review ScreenConnect sessions for unexpected remote-access clients or connections. ## Timeline - 2026-11-12 22:53 UTC: Made public by BleepingComputer on Bluesky - 2026-11-12 22:54 UTC: First seen by cve.now ## What was taken 288 records, per [BleepingComputer on Bluesky](https://www.bleepingcomputer.com/news/security/new-worm-like-sckit-malware-targets-msps-in-screenconnect-attacks/). ## Evidence (1 source) - 2026-11-12 · Press · [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3n25kr2jo4522): “A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians' computers and compromise additional managed networks.” ## Corrections None so far. Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-498d5eb864&body=https%3A%2F%2Fcve.now%2FSZB-498d5eb864%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A ## Questions about the ScreenConnect breach ### Was ScreenConnect breached? BleepingComputer on Bluesky reports it. No statement from ScreenConnect has reached cve.now yet. ### What data was exposed? 288 records. ### What should ScreenConnect customers do? Read the full BleepingComputer report for indicators of compromise. Review ScreenConnect sessions for unexpected remote-access clients or connections. ## Related - Started as early warning SZB-498d5eb864, first seen 2026-11-12 22:54 UTC - Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/SZB-498d5eb864 Site guide for agents: https://cve.now/llms.txt