Hackers Are Using a Legitimate Remote-Access Tool to Spy on Companies, and Your Antivirus Won't Notice

Key points

• Securonix researchers discovered the Smoke#Screen campaign, which uses fake Zoom and Adobe update prompts to trick victims into installing a remote-access tool criminals control.
• Once installed, the software is a legitimate, signed product called ScreenConnect, making it nearly invisible to standard antivirus or security scans.
• Attackers built five separate attack chains and connected victims to three different relay servers they controlled.
• Researchers found the criminals had accidentally left their own source code exposed on an open server, giving investigators an unusually clear view of how the operation was built.
• Both Windows and macOS computers are targeted.

A criminal hacking group has spent the last several months quietly taking over business computers using a trusted remote-support program called ScreenConnect, then using it to watch and control those computers from afar.

ScreenConnect is a real product made by ConnectWise. IT departments around the world use it to fix computers remotely, the same way a tech-support agent might take over your screen to help you. The criminals behind what researchers at Securonix are calling Smoke#Screen have turned that trusted tool into a weapon. We first reported on this campaign on 4 August when Securonix named the operation and described its initial lures; the picture is now considerably sharper.

How did the hackers get in?

Victims were tricked through fake notifications disguised as routine software updates or document requests. The lures came in four types: fake Zoom updates, fake Adobe updates, a business document to review, and a fake system-maintenance tool called "SystemCheck." Four psychologically distinct contexts, rather than variations on one theme, is a deliberate choice: it widens the pool of people likely to click.

Clicking any of them quietly installed ScreenConnect in the background. Nothing on the victim's screen looked alarming. Meanwhile, the criminals gained full, persistent access to the computer.

What made this harder to catch than usual: the attackers constantly swapped the malicious files between download attempts. Each time a new victim clicked, a slightly different version of the file arrived. Security tools that rely on recognising a specific file by its unique fingerprint, called a hash, never saw the same fingerprint twice.

Why couldn't security software catch it?

Because ScreenConnect is not malware. It carries a legitimate digital signature from ConnectWise, the company that built it. Nothing in the software itself is malicious.

"The payload isn't malware, and that's the whole problem," Aaron Beardslee, Securonix's manager of threat research, told Dark Reading. After installation, the process running on the victim's machine looks exactly like a properly authorised ConnectWise service doing its normal job, which just happens to include full remote desktop control.

Signature-based security tools, the kind that match known bad files against a database of threats, have no match to find. The attackers also routed their connections through Cloudflare tunnels, a service normally used by legitimate websites to stay fast and secure, hiding the true destination of the traffic.

What did researchers find when they looked closer?

A significant operational security mistake. The attackers left their own unfinished source code sitting in an open folder on the same server hosting their attack files. Securonix researchers could read it directly, no reverse-engineering required.

That exposed the full development history: features being added between versions, files reused under different names, and evasion layers using Dropbox for reputation, Cloudflare for anonymity, a genuine ConnectWise certificate on the final payload, and encrypted self-contained bundles. Each layer defeats a different control; no single control ever sees the whole picture.

Researchers mapped five distinct attack chains and three separate ScreenConnect relay servers. Beardslee noted that some operator behaviors seemed to contradict each other, stopping short of confirming more than one attack cluster was involved. Medium confidence on single-actor attribution seems appropriate here.

Should you worry?

If a browser window or pop-up asks you to install or update software you didn't deliberately go looking for, stop. Legitimate Zoom and Adobe updates arrive through the applications themselves, not through random prompts or email links.

Organisations can reduce exposure by setting Windows to its most cautious permission-prompt setting (called "Always notify" in User Account Control) and by configuring security software to flag any remote-support tool installed outside the IT department's approved process. Behavioural monitoring, which watches what programs do rather than what they are, is the most reliable way to catch this kind of attack. The source code sitting open on that server is a gift to defenders right now; once the operators patch that gap, the visibility disappears.