Securonix Threat Research has disclosed an active phishing campaign that installs legitimate remote support software on victim machines rather than malware. The firm published its advisory today (Aug 4), naming the campaign SMOKE#SCREEN.
A single VBScript dropper in Securonix’s telemetry led researchers to a staging server hosting 15 payloads, including scripts, .NET loaders, and a macOS installer.
At least four lure themes ran in parallel: Zoom update notices, business document reviews, system maintenance utilities, and a fake Adobe updater. Every path ended the same way, with a silent install of a ConnectWise ScreenConnect agent that beaconed to attacker infrastructure.
The ScreenConnect installer itself carried a valid Authenticode signature issued to ConnectWise through DigiCert’s trusted chain.
Securonix researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee wrote that this amounts to “a living-off-the-land technique designed to evade endpoint detections that respect code signing.”
The firm noted that abuse of the tool has grown over the past two years.
Rotating Hashes Break Static Detection
The operator also swapped payload hashes between download sessions, so files collected in separate sampling periods did not match. Hash blocklists have little purchase, and many endpoint products apply reduced scrutiny to binaries signed by a recognized software vendor.
Three relay clusters carried the traffic, each with its own key pair, and one kept a port 80 fallback to bypass outbound blocks. A macOS variant reported to the same primary relay as the Windows builds.
A mid-investigation rotation then replaced most of the toolkit. Only two of the original 15 files remained, with nine new ones deployed alongside them.
The newest loader abandoned an earlier sequence that had disabled the Antimalware Scan Interface, stripped SmartScreen protections, and added Defender exclusions covering the whole local disk. In its place was a three-minute delay between installation and service start, described in the source comments as a way to break Elastic’s correlation window.
Securonix read the change as a sign those behavioral detections were working. The firm did not attribute the activity or give a victim count.
