Sophisticated Phishing Campaign Exploits Fake Adobe and Zoom Updates to Deploy ScreenConnect RMM Tool

A cybersecurity campaign uses fake Adobe and Zoom update lures to deploy ScreenConnect RMM tools via phishing, bypassing defenses through obfuscation and legitimate service exploitation. The attack includes anti-analysis checks, privilege escalation, and persistent remote access capabilities.

Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business document reviews, and system maintenance utilities to stealthily deploy Remote Monitoring and Management (RMM) programs like ConnectWise ScreenConnect.

The campaign has been codenamed SMOKE#SCREEN by Securonix Threat

Read original article