Cybersecurity researchers have revealed an ongoing, multi-phase attack that uses fake Adobe and Zoom software updates, business document reviews, and system maintenance tools to secretly install Remote Monitoring and Management programs like ConnectWise ScreenConnect on victim computers. The campaign, dubbed SMOKE#SCREEN, was disclosed by Securonix Threat Research in a report shared with The Hacker News. Successful intrusions end with a ScreenConnect agent installed and communicating with one of three attacker-controlled relay servers, granting the perpetrators persistent remote access to compromised systems.

The operation relies on a toolkit of VBScript droppers, batch file loaders, compiled .NET executables, and an HTML phishing page, all ultimately connecting to a live WsgiDAV-based staging server at 207.174.0[.]143:8080, according to researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee. Initial access is believed to occur through spear-phishing emails that deliver an obfuscated Visual Basic Script dropper, which first runs a series of environment and anti-analysis checks to confirm safe execution. The script scans for running processes and terminates if it detects Wireshark, Process Monitor, Oracle VM VirtualBox, Broadcom VMware Tools, Citrix XenServer, or Fiddler Classic. If the environment checks pass, the script decrypts a PowerShell command that retrieves a C# payload from a remote server and executes it. A third sample linked to the activity arrives as a compressed archive, from which a batch script runs to disable Windows Antimalware Scan Interface, escalate privileges via a User Account Control prompt, turn off SmartScreen protections through Registry modifications, and then remove the Zone.Identifier alternate data stream from the downloaded MSI file before running it.

The authors write that the campaign is "particularly notable for defenders" because of "the observable arc of the actor's tradecraft," describing an evolution from cautious XOR-encrypted VBScript droppers to aggressive nine-step Defender destruction sequences and then a pivot back to stealth with anti-EDR timing and self-contained encrypted bundles. The report characterizes the campaign as "a real-time arms race between attacker and defender." An analysis of ScreenConnect relay configuration strings embedded in the MSI and EXE payloads uncovered three distinct command-and-control clusters, each tied to software update, document review, and document viewer decoy binaries. Securonix notes that the actor's delivery strategy has rotated across multiple trusted hosting services: an early phishing page delivers its payload via a Dropbox shared link, bypassing domain reputation filters since Dropbox is allow-listed in most corporate environments, while a compiled .NET loader references a Cloudflare Quick Tunnel, a service designed for temporary local server exposure that is rarely monitored.

The findings underscore the growing abuse of legitimate RMM tools by threat actors, as these programs let attackers bypass security controls and exploit their prevalence in enterprise environments to blend in with authorized IT tooling without needing to deploy a purpose-built remote access trojan. The activity hasn't been attributed to any known threat actor or group. To counter the threat, organizations are urged to restrict execution of untrusted MSI files, monitor when processes attempt to tamper with security products, audit legitimate use of RMM tools, check for suspicious PowerShell and "cmd.exe" processes, and enforce strict UAC settings to prevent standard users from bypassing UAC prompts for administrative tasks.