SCKit Malware Hijacks MSP Support Sessions

Blackpoint Cyber's Adversary Pursuit Group details SCKit malware that hijacks authenticated ScreenConnect sessions to spread to technician workstations. The attack exploits CVE-2026-84869 and uses RelayTrap to infect technicians, enabling lateral movement. ConnectWise disabled five extensions, while Huntress found a flaw in RMM+ versions 1.0.31 and 1.0.32.