Hackers Use Fake Adobe and Zoom Updates to Load Malware onto Victim Devices

Summary

Securonix Threat Research has uncovered the SMOKE#SCREEN campaign, where hackers use fake Adobe and Zoom updates, along with fraudulent business documents, to trick users into installing the legitimate but often abused ScreenConnect RMM software. This allows attackers to gain persistent remote access to both Windows and macOS devices, with the campaign evolving to disable security protections and use trusted services like Dropbox for delivery.