SMOKE#SCREEN: Fake Updates Deliver Remote Access Malware

Security researchers have identified a sophisticated cyber threat campaign dubbed SMOKE#SCREEN. This operation deceives users into installing ConnectWise ScreenConnect, a legitimate remote management tool, through deceptive pop-ups mimicking Zoom and Adobe updates. Fraudulent business documents, such as invoices and review requests, are also used as lures.

Once installed, ScreenConnect provides attackers with unauthorized remote access. This allows them to compromise sensitive data, deploy additional malware, and expand their foothold within an organization's network. The campaign is notable for its evolving tactics, including disabling security protections and utilizing trusted services like Dropbox and Cloudflare for file delivery.

This threat has been observed targeting both Windows and macOS systems. The campaign's actors are described as capable and adaptive, employing a diversified toolkit focused on achieving persistent, legitimate-looking remote access. Their methods include using multiple social engineering themes and demonstrating deliberate operational security practices.

To mitigate risks, organizations are advised to disable software updates delivered via email. Verifying update authenticity through official websites and training employees to exercise caution with unexpected attachments or installations are crucial steps. Vigilance against suspicious prompts remains key to defending against such advanced threats.