Researchers at Securonix have uncovered an active campaign they’ve named SMOKE#SCREEN in which attackers send spear-phishing emails disguised as routine software update notices — Adobe, Zoom, business document review tools, and system maintenance utilities. When a recipient runs the attachment, a chain of obfuscated scripts (VBScript droppers, batch loaders, and compiled .NET executables) quietly installs ConnectWise ScreenConnect, a legitimate remote monitoring and management (RMM) tool used by IT support teams worldwide. Once running, ScreenConnect beacons back to one of three attacker-controlled relay servers, handing the attacker persistent remote control over the machine without deploying any purpose-built malware that endpoint security tools are likely to flag.
The campaign is notable for its layered anti-analysis defenses. Before doing anything visible, the initial VBScript dropper checks for the presence of Wireshark, Process Monitor, virtual machine tools (VirtualBox, VMware, XenServer), and Fiddler — if any are running, the script aborts, concealing the infrastructure from researchers. When the environment passes those checks, the script disables Windows’ built-in Antimalware Scan Interface (AMSI) and SmartScreen protections via registry modifications, then fetches the final ScreenConnect payload from a live staging server. Because ScreenConnect is a genuine IT support tool present in many enterprise environments, the resulting traffic blends in with normal management activity, making the compromise difficult to detect without behavioral monitoring of RMM tool installations and outbound connections.