{
  "id": 19633392,
  "title": "A Blank Password Field and a Relay Trap: What the ScreenConnect SCKit Attack Actually Teaches",
  "url": "https://urgent.news/2026/11/12/a-blank-password-field-and-a-relay-trap-what-the-screenconnect-sckit",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-12T10:02:32.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/damiano_builds/a-blank-password-field-and-a-relay-trap-what-the-screenconnect-sckit-attack-actually-teaches-1icf"
  },
  "original_language": "en",
  "account": "On November 11, 2026, a malicious attack began on cloud-hosted ScreenConnect panels managed by service providers. Within 90 minutes, 288 endpoints in 48 organizations were infiltrated with controlled remote access clients. The attack, analyzed by Huntress and reported by BleepingComputer, utilized a default blank password field in an extension called RMM+. This extension bypassed ScreenConnect's authentication system, allowing unauthorized access to endpoints. The attack used the extension to deliver a malicious toolkit named SCKit, which installed a rogue ScreenConnect client and maintained a connection to the attacker's server. Although the self-propagation mechanism failed to infect other devices, the attack demonstrated the vulnerability of the blank password field and the potential for lateral movement through legitimate ScreenConnect functionality.",
  "summary": "On November 11, 2026, at 17:47 UTC, someone started pushing commands through cloud-hosted ScreenConnect panels belonging to managed service providers. Within 90 minutes, at least 288 endpoints across 48 organizations had been fitted with attacker-controlled remote access clients. About a third of them fell in the first ten minutes. That speed is the headline. The mechanism underneath it is more…",
  "key_points": [
    "Malicious attack on ScreenConnect panels began Nov 11, 2026",
    "Blank password field in RMM+ extension bypassed authentication",
    "SCKit toolkit installed rogue ScreenConnect client"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}