Fake Adobe and Zoom Updates Pose Remote Access Threat
Cybersecurity researchers uncovered a campaign using fake software updates to gain remote access.
1Campaign Details
Securonix Threat Research revealed a cyber attack campaign dubbed 'SMOKE#SCREEN'. Attackers use social engineering tactics like fake Adobe and Zoom software updates, business document reviews, and system maintenance tools to deploy Remote Monitoring and Management (RMM) programs such as ConnectWise ScreenConnect. The campaign employs VBScript droppers, batch files, and .NET applications to achieve its goals.
2Attack Methods
Attackers send obfuscated Visual Basic Script (VBScript) droppers via phishing emails. These droppers perform environment and anti-analysis checks before executing PowerShell commands. Alternatively, they use business-themed lures to trick users into running VBScripts. A successful attack results in the installation of a ScreenConnect agent, which connects to attacker-controlled relay servers.
3Technical Details
Attackers bypass domain reputation filters by using trusted hosting services like Dropbox and Cloudflare. They distribute payloads via Dropbox shared links and Cloudflare Quick Tunnels. The staging server runs WsgiDAV, and the ScreenConnect agents connect to relay servers. Attackers modify the Registry to disable Windows Defender and SmartScreen protections, ensuring persistent access.
4Impact of the Attack
The installation of the ScreenConnect agent grants attackers remote desktop access, posing a significant security threat to organizations. By mimicking legitimate RMM tool usage, attackers bypass security controls and maintain long-term access. The campaign has not yet been attributed to any known threat actor or group, making attribution difficult.
5Defense Recommendations
Organizations should restrict the execution of untrusted MSI files, monitor attempts to tamper with security products, and audit legitimate RMM tool usage. Suspicious PowerShell and 'cmd.exe' processes should be checked, and User Account Control (UAC) settings should be enforced to prevent bypassing. Security teams should also provide training to employees on social engineering attacks.
6Related Campaigns
Bitdefender warned about a separate campaign using fake Xeno Executor installers to initiate a multi-stage Java infection chain. This campaign drops an information stealer called Powercat, which can steal credentials, browser cookies, Discord and gaming accounts, and cryptocurrency wallet data. Powercat also records keystrokes, accesses webcams, and allows remote command execution.
7Campaign Timeline
The Powercat campaign is believed to have been ongoing since early 2026, with a surge observed in the second half of March. Some aspects of the campaign were documented by ThreatLocker in late March 2026. Attackers distribute Powercat via fake cheats for popular PC games. Victims running 'xeno.exe' unknowingly execute the first stage of the malware instead of the expected cheat.
8Conclusion and Recommendations
These campaigns highlight the evolving nature of cyber threats. Attackers abuse legitimate tools to bypass security measures. Organizations must adopt proactive security measures and educate employees about social engineering attacks. Security teams should continuously update their defense strategies by staying informed about emerging threats and adapting their approaches accordingly.
Original article: The Hacker News — Sahte Adobe ve Zoom Güncellemeleri ile Uzaktan Erişim Tehdidi