Back Feeds.4Sysops

Fake Adobe and Zoom updates turn ScreenConnect into a persistent backdoor

Feeds.4Sysops •IT News • August 4, 2026

A multi-wave campaign is disguising ConnectWise ScreenConnect as Adobe and Zoom updates, using spear-phishing emails and fake document portals to install persistent remote access on Windows systems. The SMOKE#SCREEN operation uses anti-analysis checks, security-control tampering, and multiple attacker-controlled relay servers to make legitimate RMM software blend into enterprise environments. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Smoke#Screen Campaign Uses Fake Updates to Install Remote Access Tool The Smoke#Screen campaign exploits social engineering tactics to install the legitimate ScreenConnect RMM tool on compromised systems, providing attackers with remote access. Targeting both Windows and macOS, the campaign utilizes fake Zoom and Adobe updates, as well as business document requests, to lure victims into executing malicious files. Researchers from Securonix reported that the campaign employs a variety of payloads, including VBScript droppers and compiled .NET executables, with a focus on rotating payloads to evade detection. The campaign's infrastructure includes multiple relay servers, allowing attackers to maintain persistent access to compromised networks. While the Windows payloads have been confirmed to infect systems, the macOS package's delivery method remains unclear, and no confirmed infections have been reported on Mac systems. The operation highlights a sophisticated approach to social engineering and malware deployment. 8 sources 70

Extracted Entities

Fake Adobe and Zoom updates turn ScreenConnect into a persistent backdoor

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)

Platforms (1)