Fake Zoom update malware campaign expands its reach to macOS

Hackers use fake Adobe and Zoom updates to load malware onto victim devices — here's what to look out for

Securonix uncovers SMOKE#SCREEN, a campaign tricking users into installing weaponized ScreenConnect via fake Zoom/Adobe updates and business docsAttackers gain persistent remote access, evolving tactics to disable protections and abuse trusted services like Dropbox/Cloudflare for deliveryVictims observed on Windows and macOS; businesses urged to verify updates via official sites and train staff against unexpected installsSecurity experts Securon…

Fake Zoom update malware campaign expands its reach to macOS

A malware campaign is using fake Zoom updates and business files to install ScreenConnect, giving attackers remote control through software that can resemble legitimate IT activity. And now, it's come to Mac.Fake Zoom updateSecuronix researchers detailed the campaign, named Smoke#Screen, in an August 4 report. They traced Windows scripts, compiled loaders, an HTML phishing page and a macOS package named "ZoomUpdateInstaller.pkg" to shared infras…

SMOKE#SCREEN Campaign Abuses ScreenConnect RMM and Cloudflare Tunnels to Hijack Windows and macOS Systems

SMOKE#SCREEN is a campaign that turns ordinary software updates and business files into a doorway for remote control. Victims who run the files can unknowingly install a legitimate remote-management agent, giving an outside operator access to their computer. The operation targets both Windows and macOS, widening the risk beyond one type of workplace device. Its lures include supposed Zoom updates, document reviews, system checks and Adobe-relate…