SMOKE SCREEN Campaign Uses Fake Software Updates to Deploy ScreenConnect

In the modern cyber threat landscape, the line between legitimate administrative operations and malicious adversary activity continues to blur at an alarming rate. Cybersecurity researchers at Securonix Threat Research recently uncovered a sophisticated, multi-wave social engineering operation dubbed the SMOKE SCREEN campaign. Operating across enterprise networks, this adversary tactic demonstrates how threat actors are eschewing bespoke malware in favor of weaponizing trusted enterprise IT tools. By distributing malicious lures themed around routine software updates for ubiquitous applications like Adobe Reader and Zoom, as well as urgent business document reviews, the SMOKE SCREEN campaign provides attackers with stealthy, administrative remote access while rendering traditional detection controls virtually blind.

First identified in early August 2026, the campaign represents a refined evolution in Remote Monitoring and Management (RMM) software abuse. Rather than relying on custom-coded Remote Access Trojans (RATs) that trigger heuristic anomalies within Endpoint Detection and Response (EDR) platforms, the operators behind the campaign covertly deploy signed, commercial instances of ConnectWise ScreenConnect. Coupled with multi-stage droppers, obfuscated VBScript chains, and custom staging infrastructure, the operation highlights a dangerous trend: adversaries leveraging legitimate administrative software to establish persistent, outbound-controlled beachheads across both Windows and macOS endpoints.

Deconstructing the Lures: Social Engineering and Decoy Engineering

The entry point for the attack vector relies heavily on human-targeted social engineering designed to exploit everyday corporate workflows. Threat actors initiate contact through highly targeted spear-phishing emails that trick employees into interacting with malicious downloads or fraudulent HTML landing pages. The lures are meticulously crafted to mirror routine administrative tasks that corporate workers encounter on a daily basis. Primary decoy themes include:

• Urgent Software Update Prompts: Fake notifications directing users to update critical productivity tools, specifically Adobe Acrobat/Reader and Zoom collaboration software.
• Corporate Document Reviews: Impersonated corporate communications, such as employee performance reviews, official legal notices, and Social Security Administration (SSA) benefit or compliance statements requesting digital signatures.
• IT Maintenance Utilities: Spoofed internal IT advisories prompting users to execute mandatory system diagnostic or maintenance scripts.

What sets this multi-wave operation apart is its agility in decoy rotation and cross-platform expanding reach. While historical RMM campaigns focused exclusively on Windows environments, security analysts observed variant payloads explicitly tailored for macOS systems. Users downloading these fake update installers or document viewers trigger an automated, multi-tiered