Cybersecurity researchers have uncovered a campaign named SMOKE#SCREEN that uses fake Adobe and Zoom updates, business document requests, and system maintenance tools to trick users into installing remote access software.
According to Securonix Threat Research, the campaign uses multiple malware components, including VBScript droppers, batch scripts, .NET executables, and phishing HTML pages. The tools connect to a WsgiDAV-based staging server that stores malicious files and helps attackers control infected systems.
The final stage of the attack installs ConnectWise ScreenConnect, a legitimate Remote Monitoring and Management (RMM) tool. Once installed, the ScreenConnect client connects to attacker-controlled relay servers, allowing remote access and control of compromised devices.
Researchers found that the campaign begins with spear-phishing emails containing malicious attachments or links. Some attacks use fake Zoom update pages, while others use business-related document themes to convince victims to run scripts.
The VBScript malware performs security checks before continuing. It searches for analysis tools such as Wireshark, Process Monitor, VirtualBox, VMware Tools, Citrix XenServer, and Fiddler. If any of them are detected, the malware stops execution to avoid detection.
If the checks pass, the script decrypts a PowerShell command that downloads a C# payload from an attacker-controlled server. Batch files are used to disable security protections, including Windows Antimalware Scan Interface (AMSI) and SmartScreen, before launching the malicious installer.
Securonix also found three separate command-and-control clusters connected to different fake software update, document review, and document viewer campaigns. Despite the different themes, all attack vectors lead to the installation of ScreenConnect.