Back Securityaffairs.Co

SMOKE#SCREEN Campaign Abuses ScreenConnect to Give Attackers Remote Control Access

Securityaffairs.Co •Pierluigi Paganini • August 5, 2026

SMOKE#SCREEN uses fake Zoom updates to install ScreenConnect RMM, giving attackers persistent remote access while bypassing defenses. Securonix Threat Research has been tracking an active multi-wave campaign they’ve named SMOKE#SCREEN, in which unknown attackers use rotating social engineering lures, fake Zoom updates, Adobe software notices, business document reviews, system maintenance utilities, to silently install ConnectWise […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Smoke#Screen Campaign Uses Fake Updates to Install Remote Access Tool The Smoke#Screen campaign exploits social engineering tactics to install the legitimate ScreenConnect RMM tool on compromised systems, providing attackers with remote access. Targeting both Windows and macOS, the campaign utilizes fake Zoom and Adobe updates, as well as business document requests, to lure victims into executing malicious files. Researchers from Securonix reported that the campaign employs a variety of payloads, including VBScript droppers and compiled .NET executables, with a focus on rotating payloads to evade detection. The campaign's infrastructure includes multiple relay servers, allowing attackers to maintain persistent access to compromised networks. While the Windows payloads have been confirmed to infect systems, the macOS package's delivery method remains unclear, and no confirmed infections have been reported on Mac systems. The operation highlights a sophisticated approach to social engineering and malware deployment. 8 sources 70

Extracted Entities

SMOKE#SCREEN Campaign Abuses ScreenConnect to Give Attackers Remote Control Access

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (2)

Platforms (1)

Tools (1)