Fake Adobe and Zoom Updates Install Screen Connect for Persistent Remote Access
Summary: Securonix Threat Research documented an active multi-wave campaign it codenamed SMOKE#SCREEN that uses fake Adobe and Zoom update, document review, and system maintenance lures to install ConnectWise ScreenConnect, with a toolkit of VBScript droppers, batch loaders, .NET executables, and an HTML phishing page pointing to a WsgiDAV staging server at 207.174.0[.]143:8080. Successful attacks end with a ScreenConnect agent beaconing to one of three attacker-controlled relay servers, and the activity has not been attributed to any known threat actor or group.
Bottom line: The campaign abuses a legitimate RMM tool that is already allow-listed in most enterprises, and its delivery rotated through Dropbox shared links and a Cloudflare Quick Tunnel (subscription-magnetic-recommended-meat.trycloudflare.com) specifically because those services are trusted or rarely monitored.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026