Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access

Securonix Threat Research has documented an active campaign, tracked as SMOKE#SCREEN, that uses fake Adobe and Zoom update prompts to install ConnectWise ScreenConnect on victim machines. The lure works because it mirrors something your staff are told to do constantly: apply the update, close the vulnerability, move on. (Source: The Hacker News)

ScreenConnect is a legitimate Remote Monitoring and Management (RMM) product that IT teams use for help-desk sessions and unattended access. In this campaign, the attackers install the real signed client and point it at their own relay servers, which gives them an interactive remote desktop session on the host.

That choice of tooling is deliberate. An RMM agent carries valid vendor signatures and looks like sanctioned IT software, so it blends in with the remote-support tools already running across most enterprise fleets and removes the need for a purpose-built remote access trojan.

"The campaign relies on a toolkit of VBScript droppers, batch file loaders, compiled .NET executables and an HTML phishing page, all ultimately pointing to a live WsgiDAV-based staging server at 207.174.0[.]143:8080," Securonix researchers Shikha Sangwan, Akshay Gaikwad and Aaron Beardslee wrote.

The lures are not limited to software updates. Securonix found decoy binaries themed around business document reviews, document viewers, and system maintenance utilities, with the embedded ScreenConnect relay configuration strings resolving to three distinct command-and-control clusters — one tied to each decoy theme.

Delivery rotates through hosting services your filters already trust. One phishing page, zoom-update.html, pulled its payload from a Dropbox shared link, which sidesteps domain reputation checks because Dropbox is allow-listed in most corporate environments. A compiled .NET loader referenced a Cloudflare Quick Tunnel, and the staging server itself ran cloudflared.exe to generate those short-lived tunnels.

The outcome is the same across every path: a ScreenConnect agent beaconing out to an attacker-controlled relay, with a hands-on operator able to open a session against the machine whenever they choose. The activity has not been attributed to any known threat actor.

Attack Chain: From Fake Installer to Persistent Backdoor

The chain begins with an obfuscated VBScript dropper delivered by spear-phishing. Before it does anything else, the script enumerates running processes and terminates itself if it finds analysis or virtualization tooling on the host:

• wireshark.exe (Wireshark) and fiddler.exe (Fiddler Classic) — traffic capture
• procmon.exe (Process Monitor) — process and file system tracing
• vboxservice.exe, vmtoolsd.exe, xenservice.exe — VirtualBox, VMware Tools, and XenServer guest services

That check maps to MITRE ATT&CK T1497 (Virtualization/Sandbox Evasion). The practical effect is that a sample detonated in an automated sandbox often looks inert, so a submission that comes back clean does not mean the file is safe.

When the checks pass, the script decrypts a PowerShell command that retrieves a C# payload from 207.189.11[.]170 and executes it (T1059.005 into T1059.001). Early samples used XOR-encrypted VBScript; later ones shifted to self-contained encrypted bundles with anti-EDR timing delays.

A separate delivery path arrives as a compressed archive containing a batch loader that clears defenses before the installer ever runs. It disables the Antimalware Scan Interface (AMSI), the Windows component that lets security products inspect scripts in memory, triggers a User Account Control prompt to escalate privileges, turns off SmartScreen through registry modification, then strips the Zone.Identifier alternate data stream from the downloaded MSI.

Removing that ADS deletes the mark-of-the-web flag (T1553.005), so Windows treats an internet-sourced MSI as a local file and suppresses the warning your users would normally see. Securonix also documented a nine-step Microsoft Defender takedown sequence in one wave of samples.

Staging runs through a live WsgiDAV server at 207.174.0[.]143:8080. WsgiDAV is a Python WebDAV server, which gives the operator ordinary HTTP file hosting for payload delivery while the same box maintains command and control over already-infected machines via a ScreenConnect relay on port 8041.

Configuration strings pulled from the MSI and EXE payloads resolved into three distinct C2 clusters, each paired with its own decoy binary theme: software update, document review, and document viewer. Separate infrastructure per lure means blocking one cluster leaves the other two operational.

Delivery hosts rotate across services your filters already trust. The phishing page zoom-update.html pulls its payload from a Dropbox shared link, and the .NET loader MemoryLoader.cs references a Cloudflare Quick Tunnel at subscription-magnetic-recommended-meat.trycloudflare.com. The staging server runs cloudflared.exe directly, generating ephemeral tunnels that expire before most reputation feeds catch up.

A parallel campaign documented by Bitdefender shows the same loader-then-payload structure in a consumer-facing form. Archives posing as the Xeno Executor Roblox cheat instruct victims to run xeno.exe, which checks for a Java Runtime Environment, extracts one if absent, and reads keys from a local XenoIcon.jpg to validate execution against solthere[.]net.

Stage two is an obfuscated JAR renamed decompiler.exe. It runs its own environment checks, registers the victim, and fetches the third stage — Powercat, a Java stealer with keylogging, webcam capture, desktop streaming, file transfer, PowerShell execution, and an interactive shell for hands-on-keyboard access.

Powercat first inventories installed software to decide what to steal, covering Brave, Chrome, Edge, Opera GX and Vivaldi profiles, Atomic and Exodus wallets, Git and JetBrains tooling, Steam and Battle.net, NordVPN and Mullvad, plus Discord and Telegram. Against Exodus version 26.1.5 it unpacks the app.asar archive and injects JavaScript to capture valid session tokens.

Both chains end in interactive operator control over the host, which means an incident scoped as credential theft can extend into file destruction or reuse of the machine in further criminal activity.

Business and Operational Impact of Undetected Remote Access

Persistent ScreenConnect access gives an operator an interactive remote desktop session on your endpoint, which changes what "compromise" means in practice. There is no custom remote access trojan to detect and no exfiltration tool to flag, because the operator can simply open your file shares, copy documents to their own machine, and read whatever the logged-on user can read.

Securonix identified three distinct C2 clusters in the relay configuration strings, each tied to a different decoy theme: software update, document review, and document viewer binaries. That separation suggests parallel target sets, and if your organization sees one lure theme, the same operator infrastructure supports others. The relay listens on port 8041, which is an unremarkable high port in most egress rules.

What the operator inherits from a single click

Because the session runs with the privileges of the user who approved the installer, the attacker inherits that person's mapped drives, cached credentials, SSO tokens, and mail client. In one delivery path the batch script disables the Antimalware Scan Interface, turns off SmartScreen through registry modifications, and strips the Zone.Identifier alternate data stream from the downloaded MSI so Windows no longer treats it as a file from the internet. Your endpoint stops applying the checks it was configured to apply, and later stages arrive on a host that has been quietly downgraded.

The practical consequences follow the access, not the malware:

• Credential harvesting from browser stores, password managers left unlocked, and RDP or VPN clients configured for saved sessions
• Lateral movement using your own administrative tooling, since the operator is working from a trusted, domain-joined workstation
• Data staging and theft of contracts, financial records, and client files through a session your network already permits
• Hands-on reconnaissance of your backup consoles, hypervisor management, and finance systems ahead of any ransomware decision

The campaign has not been attributed to a known group, so intent is unresolved. Access of this quality is routinely sold or handed to a second operator, which means the party who phished your user may not be the party that eventually encrypts your servers.

Why detection can lag by weeks

Securonix described the actor's most recent shift as a return to stealth using anti-EDR timing and self-contained encrypted bundles, following an earlier phase that included a nine-step Defender destruction sequence. Delivery has rotated across trusted hosting: an early phishing page pulled its payload from a Dropbox shared link, and a compiled .NET loader referenced a Cloudflare Quick Tunnel generated by cloudflared.exe running on the staging server itself. Your domain reputation filters pass all of that, because Dropbox is allow-listed in most corporate environments and Quick Tunnel subdomains are ephemeral and rarely monitored.

If your help desk already uses RMM software for unattended access, an extra agent beaconing outbound looks like your own tooling in a process list. Dwell time in that condition is measured by whatever happens to trigger a review, which may be an unexplained wire transfer, a vendor notifying you of a spoofed invoice, or a ransom note.

If the affected workstation touches personal data, health records, or payment information, you are dealing with a notifiable event under GDPR, HIPAA, or state breach statutes, and the interactive nature of the access makes scoping harder. You will need to establish what the operator viewed during each session, and remote desktop activity leaves fewer artifacts than a file-copying malware sample would.

Immediate Detection and Response Actions

Start with an inventory: pull every ScreenConnect client installation and service across your fleet and compare each one's relay configuration against the help-desk instance your IT team actually owns. Any agent pointing at a relay you don't control is an active intruder session, not a stale install, and it should be isolated before you begin analysis.

Alongside that, run these hunts today:

• Outbound connections to 207.174.0.143:8080 (the WsgiDAV staging host) and 207.189.11.170, plus any traffic on the relay port 8041.
• Presence or execution of cloudflared.exe on user endpoints and DNS lookups for *.trycloudflare.com, including subscription-magnetic-recommended-meat.trycloudflare.com referenced by the .NET loader. Quick Tunnel traffic from a workstation is almost never legitimate business use.
• Process ancestry where msiexec.exe is launched by cmd.exe, a batch file, or wscript.exe, and any process that strips the Zone.Identifier alternate data stream from a downloaded file before running it. That removal is what suppresses the mark-of-the-web warning your users would otherwise see.
• AMSI tampering, Windows Defender service or exclusion changes, and SmartScreen policy modifications in the same session window. In environments Capstone manages, SentinelOne flags and blocks this kind of endpoint-protection tampering, which is the step the batch loader depends on before the MSI ever runs.

Because the campaign also delivers a Java-based stealer through fake game cheats, sweep for xeno.exe, decompiler.exe, and XenoIcon.jpg, unexpected Java Runtime extractions into user profile directories, and connections to solthere.net. On any host with a cryptocurrency wallet, check whether the Exodus app.asar archive has been modified — version 26.1.5 is specifically targeted for JavaScript injection that captures wallet tokens.

This week, move to containment and delivery-path review. Block the staging IPs and the relay endpoint at your perimeter, restrict Quick Tunnel domains, and review proxy logs for Dropbox shared-link downloads tied to zoom-update.html — Dropbox is allow-listed in most corporate environments, so those requests pass reputation filtering without comment.

Confirm that Adobe and Zoom updates reach your users only through your patch management system, then tell staff plainly that any in-browser or emailed update prompt is not how your organization delivers software. Audit interactive logons, RDP sessions, and UAC elevation approvals on affected hosts, since the loader escalates by prompting the user rather than exploiting a flaw. If a user approved that prompt, treat the account's credentials and session tokens as exposed and reset them.

For the longer term, application control does the most work here. Restrict msiexec.exe execution of MSI packages from user-writable paths such as Downloads and Temp, and allow only packages signed by publishers you approve. Enforce UAC settings so standard users cannot approve elevation for administrative tasks at all.

Then baseline RMM usage: document the single remote-access product your team uses, and alert on the installation or execution of any other RMM binary, regardless of valid code signing. A signed installer tells you the file is authentic; it tells you nothing about who configured the relay it connects to. Add a detection rule for new RMM service creation on endpoints, and review the hits weekly.

Preventing Fake Update Attacks in Adobe and Zoom Environments

The most effective control here is removing users' ability to install software at all. The batch-file variant of this campaign escalates privileges through a standard User Account Control prompt, which only works when the person sitting at the keyboard can approve it. Strip local administrator rights from standard accounts and set UAC to require administrator credentials for elevation, so a consent click alone cannot install an MSI.

Next, take update delivery out of the user's hands entirely. Push Adobe Acrobat/Reader and Zoom updates through Intune, SCCM, or WSUS in staged rings and disable the in-application auto-update and update-check UI through vendor policy settings. Once your users never legitimately see an update prompt, every prompt they do see is reportable by definition, and that single rule is easier to train than teaching people to spot a convincing fake.

Pair that with application control. Configure AppLocker or Windows Defender Application Control to block execution of MSI and script files from user-writable directories, since installers arriving by phishing land in the same handful of paths:

• Deny msiexec installs sourced from %TEMP%, %USERPROFILE%\Downloads, and %APPDATA%
• Block wscript.exe and cscript.exe execution for standard users, which removes the VBScript delivery path outright
• Allow only your one approved RMM publisher and block other remote-access agent binaries by signer, so an unapproved installer fails even if a user runs it

Watch for the tampering steps that precede installation. Securonix documented the loader disabling the Antimalware Scan Interface (AMSI), turning off SmartScreen through registry modifications, and stripping the Zone.Identifier alternate data stream from the downloaded MSI so Windows treats a file from the internet as locally sourced. Alert on registry writes to SmartScreen policy keys and on AMSI provider changes; these actions have almost no legitimate cause on a user endpoint and they arrive minutes before the remote session opens.

Your mail gateway needs adjusting too. The zoom-update.html phishing page delivered its payload through a Dropbox shared link, which sidesteps domain reputation filtering because most corporate environments allow-list the platform. Treat cloud-storage download links in inbound mail with the same scrutiny you apply to attachments, and restrict which file-sharing tenants your users can reach from managed devices.

Because the elevation prompt and the follow-on session both depend on a valid user context, watch the identity layer as well as the endpoint. Adlumin flags privilege-elevation and authentication anomalies across managed environments, which surfaces a standard account suddenly performing administrative actions on its own workstation.

On the awareness side, explain the mechanism to your staff instead of showing them screenshots. This lure works because patching is a habit your security team has spent years reinforcing, and because "Adobe" and "Zoom" carry more trust than any sender address. Give people one concrete rule: a genuine update never appears as a browser page, an emailed HTML file, or a document that asks you to run an installer to view it.

Finally, make reporting faster than complying. Add a one-click report button in Outlook, tell your help desk that "I clicked an update prompt" is a routine call rather than a disciplinary matter, and confirm through your deployment tool which machines are genuinely due for an Adobe or Zoom update. A prompt on a device your own patch schedule shows as current is your earliest signal that someone in your environment was targeted.

What to Prioritize If You Suspect Infection

A ScreenConnect agent beaconing to a relay your help desk does not own means a person had interactive control of that machine. Scope your response to that assumption, because the software itself was never the payload — the operator's session was.

Securonix documented variants that disable the Antimalware Scan Interface (AMSI), turn off SmartScreen through registry modifications, and run a nine-step sequence against Microsoft Defender. If the host you are looking at ran one of those, its security tooling was altered before you started asking questions, so a clean on-demand scan tells you very little about what happened while the operator was connected.

The questions that determine how large your incident actually is:

• How long the agent was installed and beaconing, which sets the window an operator could have worked in.
• Which account was logged on during that window, and what that account could reach — mapped shares, saved browser sessions, VPN profiles, cached mail.
• Whether the same account authenticated to other hosts afterward, since credential reuse is the cheapest way for an operator to move on from the first machine.

Securonix also noted the actor's most recent samples pair anti-EDR timing with self-contained encrypted bundles. Matching a single hash or file name is therefore a weak basis for declaring a host clean, and absence of a known indicator is not absence of the operator.

Treat a confirmed finding as an incident that needs investigation and credential resets across everything that account touched, handled with your incident response provider. Reimaging the one machine and closing the ticket leaves the rest of the question unanswered.