ScreenConnect Attackers Hide Windows, Delete Installers and Masquerade as Software Updates

Gbhackers •Mayura Kathir • August 5, 2026

ScreenConnect is being systematically weaponized in the SMOKE#SCREEN campaign, where attackers hide execution windows, delete installers, and disguise malicious activity as routine software updates to plant fully functional, signed ScreenConnect agents across Windows and macOS endpoints. The result is persistent, “legitimate-looking” remote access that blends into normal IT operations while silently bypassing user awareness and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Smoke#Screen Campaign Uses Fake Updates to Install Remote Access Tool The Smoke#Screen campaign exploits social engineering tactics to install the legitimate ScreenConnect RMM tool on compromised systems, providing attackers with remote access. Targeting both Windows and macOS, the campaign utilizes fake Zoom and Adobe updates, as well as business document requests, to lure victims into executing malicious files. Researchers from Securonix reported that the campaign employs a variety of payloads, including VBScript droppers and compiled .NET executables, with a focus on rotating payloads to evade detection. The campaign's infrastructure includes multiple relay servers, allowing attackers to maintain persistent access to compromised networks. While the Windows payloads have been confirmed to infect systems, the macOS package's delivery method remains unclear, and no confirmed infections have been reported on Mac systems. The operation highlights a sophisticated approach to social engineering and malware deployment. 8 sources 70

Extracted Entities

ScreenConnect Attackers Hide Windows, Delete Installers and Masquerade as Software Updates

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)

Platforms (2)

Tools (1)