{"id":4210,"date":"2026-11-12T07:04:01","date_gmt":"2026-11-12T15:04:01","guid":{"rendered":"https:\/\/cyber.mag212.com\/mag212-cyber-daily-2026-11-12-screenconnect-kev-zoom-qlik-antifox\/"},"modified":"2026-11-12T07:04:01","modified_gmt":"2026-11-12T15:04:01","slug":"mag212-cyber-daily-2026-11-12-screenconnect-kev-zoom-qlik-antifox","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/mag212-cyber-daily-2026-11-12-screenconnect-kev-zoom-qlik-antifox\/","title":{"rendered":"MAG212 CYBER Daily \u00b7 12 novembre 2026\u00a0: Attaques contre ScreenConnect MSP, date limite pour KEV, Zoom, Qlik et AntiFox"},"content":{"rendered":"\n
\n
Download the PDF (18 pages)<\/a><\/div>\n<\/div>\n\n\n\n

MAG212 CYBER \u00b7 Daily Cyber Intelligence \u00b7 Thursday, November 12, 2026 \u00b7 Research cutoff 06:00 PT.<\/strong> Trusted tools, hostile hands. Attackers turned MSPs\u2019 own ScreenConnect consoles against their customers, pushing rogue clients and a toolkit called SCKit to at least 288 endpoints in 90 minutes, most likely through a weakness in a third-party extension. Four exploited flaws hit their CISA KEV deadline today, and an open-source AI pentest platform turned up in real intrusions that read an AWS production secret.<\/p>\n\n\n\n

What needs attention today<\/h2>\n\n\n\n
#<\/th>Action<\/th>How<\/th><\/tr><\/thead>
1<\/td>MSPs and customers: hunt rogue ScreenConnect clients, don\u2019t remote in<\/strong><\/td>Investigate suspect devices with separate tools; keep the five disabled extensions (RMM+ first) off; review Run Command and Toolbox history; revoke sessions and reset credentials from a clean device. Look for client IDs 2588ef5c15954b10 and ed630cc2c873b091 and a TrapWatch task; clean infected hosts fully before un-isolating them.<\/td><\/tr>
2<\/td>Close out today\u2019s four KEV deadlines<\/strong><\/td>OpenSSH 10.6p2 on musl\/Alpine (or PasswordAuthentication no), GPUStack 2.2.0 or later, FreeSWITCH 1.11.3, Aspera Faspex 5.0.19 PL1, then check exposed systems for compromise.<\/td><\/tr>
3<\/td>Patch the wide-footprint criticals this week<\/strong><\/td>Zoom Workplace for Windows 7.1.8; Apache httpd 2.4.71 (or drop h2\/h2c); Ivanti EPM 2024 SU8 and CSA 5.0.8.1. None is reported exploited yet.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Read the full stories<\/h2>\n\n\n\n