New threat to remote support software: what we're doing
Flotek has not been affected
Security researchers at Huntress have warned about a new threat to ScreenConnect. Flotek has not been affected, but we’re taking action as a precaution. Here’s what’s happening, in plain English.
What is ScreenConnect?
ScreenConnect is remote support software. When you call an IT helpdesk and an engineer takes control of your screen to fix a problem, they’re often using a tool like this. Many IT providers use it, which is why it’s an attractive target for criminals.
What is a worm?
A worm is a type of malicious software that’s designed to spread itself from one computer to others, rather than needing someone to open an email attachment or click a link on each one. This one has been named the ‘SCKit worm’.
What does this one do?
According to Huntress, it does two things:
- It plants a hidden back door. It quietly installs the criminals’ own copy of ScreenConnect on a computer, so they can get back in whenever they like.
- It tries to steal an IT engineer’s access. When an engineer connects to an infected computer to help, it tries to grab the digital pass that keeps them logged in. With that, the criminals could try to reach every other computer that engineer looks after.
Huntress first saw it on 11 November 2026. It says at least 288 computers across 48 organisations that use Huntress were affected, all within about 90 minutes. Huntress says it hasn’t seen the worm successfully spread itself so far, and ConnectWise, which makes ScreenConnect, has issued its own warning.
What we’re doing
As a precaution, we’re removing ScreenConnect from all devices. The only exceptions are a small number of co-managed partners, and Craig Jones, our Group IT Director, has already been in touch with them directly.
If you have any questions, get in touch with our team.
If your business uses ScreenConnect itself
Pass this to whoever manages your IT. Huntress recommends they:
- Check ScreenConnect’s activity history for anything unexpected run on lots of computers at once.
- Look for a second, unauthorised copy of ScreenConnect on your computers.
- Avoid connecting to any computer they think is infected through ScreenConnect, and use a different tool instead.
- Log everyone out of ScreenConnect and change any passwords that may have been exposed.
Huntress’s full technical write-up is on its blog.
Want a second pair of eyes on the tools your business relies on? Our cyber security team can help, including through our CyberGuard Security service.
Source: Huntress, 11 Nov 2026.
Further reading
Want it fixed and kept that way? From just £14 a month, we verify your domain and monitor it 24/7, so your email lands and nobody else can send as you.
