ScreenConnect panels used to push SCKit to 288 devices
Attackers took over cloud-hosted ConnectWise ScreenConnect panels and used them to push a custom toolkit called SCKit to at least 288 managed devices across 48 organizations. Huntress first saw the activity on November 11, 2026, and says all 288 hosts were hit within about 90 minutes. Cloud panel abuse and rapid spread The attacker used ScreenConnect’s Run command feature to send commands to many endpoints at once. Those commands ran…