security: SCKit abuses ScreenConnect to deploy remote access and target technician sessions
Microsoft Security Blog
2026-11-13
Microsoft describes SCKit abusing ScreenConnect to deploy unauthorized remote access and target technician sessions. The post outlines the attack chain, mitigations, and Microsoft Defender XDR hunting guidance.