Security researchers have detailed a campaign dubbed SMOKE#SCREEN that uses SMOKE#SCREEN fake updates themed around well-known software. Instead of delivering real patches, the lures push victims toward installing remote monitoring and management tooling—most notably the ScreenConnect client—so attackers can keep access long after the initial breach.
The activity blends social engineering with multi-stage delivery components, infrastructure designed to stage payloads, and operational techniques intended to delay detection. Researchers say the campaign has not been linked to a specific threat actor or group.
How SMOKE#SCREEN fake updates lead to ScreenConnect
According to the reporting, the campaign runs in multiple waves and relies on different “trusted” themes—such as Adobe and Zoom update messages, business document review decoys, and system maintenance utilities. The goal is consistent: get the recipient to execute malicious code that ultimately installs an RMM program for persistent remote access.
Researchers describe a toolkit that includes VBScript droppers, batch file loaders, compiled .NET components, and an HTML phishing page. These paths converge on a live staging point hosted on a WsgiDAV-based server.
Successful infections end with a ScreenConnect agent installing and “beaconing” through relays controlled by the attackers. By routing traffic through configured relay infrastructure, operators gain ongoing remote connectivity to the compromised system.
Staging and command-and-control via WsgiDAV and relays
A key part of the campaign is the use of a WsgiDAV-based staging server. Researchers note that this server served two purposes: delivering malicious payloads and supporting command-and-control through a ScreenConnect relay.
While examining embedded configuration strings inside ScreenConnect relay data found in the MSI and EXE payloads, analysts identified multiple command-and-control “clusters.” These clusters map to decoy themes, including update-related lures, document review themes, and document viewer decoys.
Initial access relies on spear-phishing and obfuscated scripts
Investigators assess that initial access is most likely spear-phishing. The emails act as the delivery mechanism, often leading to an obfuscated VBScript that starts with environment and anti-analysis checks.
In one documented behavior set, the script enumerates running processes and aborts execution if it detects certain security- and analysis-related tools. Examples called out in the findings include:
- Wireshark (wireshark.exe)
- Process monitoring tools like Process Monitor (procmon.exe)
- Virtualization and analysis environments such as Oracle VirtualBox (vboxservice.exe)
- Broadcom VMware Tools (vmtoolsd.exe)
- Citrix XenServer tools (xenservice.exe)
- Network testing utilities like Fiddler (fiddler.exe)
If the checks pass, the script decrypts a PowerShell command that retrieves a payload written in C# from an external host and executes it. Researchers also observed variants where business-themed lures trick recipients into running a VBScript that still leads to ScreenConnect installation.
Privilege and security bypass behaviors in later stages
One sample tied to the campaign was delivered as a compressed archive. After extraction, a batch script initiated a chain of actions designed to reduce defenses and increase execution control.
Notably, the batch process described by researchers includes steps to:
- Disable protections related to Windows Antimalware Scan Interface (AMSI)
- Escalate privileges using a User Account Control (UAC) prompt
- Turn off SmartScreen protections through registry modifications
- Remove the Zone.Identifier alternate data stream (ADS) from a downloaded MSI file before execution
These actions indicate an intent to run malicious components more reliably on Windows endpoints by reducing common barriers for unsigned or suspicious software.
Infrastructure and hosting rotation to evade reputation checks
Researchers report that the delivery strategy rotates across multiple hosting services. In one early phishing example themed around a Zoom update, the payload is delivered via a shared link hosted on a platform that is frequently allow-listed in enterprise environments.
The reporting also describes a compiled .NET loader that references a cloud tunneling service. Such tunnels are designed to expose local services temporarily, and the campaign’s observed staging approach used cloud-based binaries hosted on attacker-controlled infrastructure to generate ephemeral access paths.
Even though the tooling and hosting differ between samples, analysts emphasize that the campaign’s ultimate endpoint remains the same: installation of the ScreenConnect client configured to connect to attacker-controlled relays.
Why defenders should care: abuse of legitimate RMM tooling
What makes SMOKE#SCREEN fake updates particularly challenging for defenders is that it leverages widely used RMM software rather than deploying a custom remote-access trojan. Because RMM tools are common in enterprise IT environments, malicious activity can blend into expected administrative patterns.
Researchers also point to an evolving “tradecraft arc”—starting from cautious, encrypted VBScript droppers, moving through more aggressive defense disruption behavior, and later shifting back toward stealth features such as anti-EDR timing and self-contained encrypted payload bundles.
In practical terms, this evolution suggests the campaign operators continuously adjusted based on defensive pressure.
Recommended security actions
To reduce risk from similar campaigns, researchers recommend a combination of endpoint control, monitoring, and configuration hardening. Key defensive measures include:
- Restrict execution of untrusted MSI files
- Monitor process tampering attempts against security products
- Audit legitimate RMM tool usage and validate expected administrative workflows
- Watch for suspicious PowerShell and cmd.exe process activity patterns
- Enforce strict UAC settings to prevent standard users from bypassing UAC prompts for administrative tasks
Related warning: fake game installers used to deliver a Java stealer
In a separate disclosure, Bitdefender warned about another campaign using gaming-themed lures to spread malware through fake installers. This activity promoted bogus cheats associated with a popular gaming theme and led to a multi-stage Java infection chain.
That reported malware includes an information-stealing component capable of extracting sensitive data, recording keystrokes, capturing webcam and desktop activity, and providing interactive remote control features to attackers. The payload was observed targeting a range of applications including multiple web browsers, cryptocurrency wallet software, developer tools, VPN clients, messaging apps, and specific Roblox and Minecraft installations.
While this second campaign is distinct from ScreenConnect-focused activity, it reinforces a common theme: attackers continue to exploit user interest—whether through “updates” or “cheats”—to get code onto systems in ways that appear routine or harmless.
Conclusion
SMOKE#SCREEN fake updates shows how threat actors can turn familiar software themes into a delivery pipeline for persistent remote access. By combining spear-phishing, obfuscated scripting, environment checks, staged payload infrastructure, and ScreenConnect relay configuration, attackers can establish continued control while blending into legitimate enterprise tooling.
Organizations that harden endpoint execution policies, closely monitor suspicious scripting and security-bypass behaviors, and validate RMM usage are better positioned to disrupt these intrusions early and prevent long-term remote access.
Source: https://thehackernews.com/2026/08/fake-adobe-and-zoom-updates-install.html
