RelayTrap

SCKit Malware Toolkit Targets MSPs in ScreenConnect Attacks Using Worm-Like RelayTrap

A new worm-like malware toolkit named SCKit was deployed in recent ScreenConnect attacks targeting managed service providers. The toolkit uses a component called RelayTrap to exploit the patched vulnerability CVE-2026-84869 and attempt to spread from infected customer devices to MSP technicians' workstations. Researchers from Huntress and Blackpoint Cyber recovered the full loader and components directly from attacker infrastructure, noting that the source code appears LLM-generated with extensive comments. The attacks leveraged an authentication flaw in the RMM+ extension versions 1.0.31 and 1.0.32, allowing unauthenticated command execution across at least 288 endpoints in 48 organizations. Although the worm-like propagation failed against patched clients, attackers successfully installed rogue ScreenConnect clients and attempted to steal authentication cookies for session hijacking. ConnectWise responded by disabling five third-party extensions across approximately 400 partner environments.