# Malicious ScreenConnect Add-ons Threaten Managed Service Providers

*Published November 13, 2026*
*Source: [https://www.bleepingcomputer.com/news/security/new-worm-like-sckit-malware-targets-msps-in-screenconnect-attacks/](https://www.bleepingcomputer.com/news/security/new-worm-like-sckit-malware-targets-msps-in-screenconnect-attacks/)*

## Executive Summary

A new cyber attack campaign targets managed service providers using worm-like SCKit malware and malicious ScreenConnect add-ons to spread rogue remote-access clients. This attack threatens MSP networks, impacting both providers and their clients, and demands immediate security enhancements to mitigate risks.

*This is a Premium edition: its actionable insights are available to sec-news.ai Premium members —*
*[read the story](https://www.sec-news.ai/news/malicious-screenconnect-add-ons-threaten-managed-service-providers) or [see plans](https://www.sec-news.ai/pricing).*

## Article

Recent cyber attacks have put managed service providers (MSPs) in a challenging position as a malicious campaign has been spreading rogue remote-access clients through worm-like SCKit malware and malicious ScreenConnect add-ons. These threats have been actively deployed to infiltrate MSP networks, impacting not only the providers themselves but also their customers and partners. The malware operates by embedding itself into systems using remote-access software, which many MSPs rely on for efficient client management. Once inside, the malware can spread rapidly, compromising sensitive data and potentially disrupting operations.

The primary targets of these attacks are MSPs that use the ScreenConnect software, now known as ConnectWise Control, to manage client systems. This attack vector is particularly concerning because it leverages trusted software to deploy unauthorized access tools, making detection and prevention more challenging. The malicious add-ons are designed to blend seamlessly into legitimate operations, allowing attackers to bypass traditional security measures and maintain persistence within the networks.

The impact of these attacks extends beyond financial loss and operational downtime. MSPs face reputational damage and the loss of client trust, which are critical in this competitive industry. In response to these threats, MSPs need to enhance their security measures. Immediate actions include conducting comprehensive security audits, implementing advanced threat detection tools, and educating staff and clients about the risks and signs of compromise. Regularly updating and patching software, especially remote-access tools, is also crucial in mitigating these risks.

Organizations must remain vigilant and proactive in their approach to cybersecurity. Collaboration with cybersecurity experts and staying informed about emerging threats will aid MSPs in safeguarding their networks and maintaining the trust of their clients.