Hackers Are Using a Legitimate Remote-Access Tool to Spy on Companies, and Your Antivirus Won't Notice

Key points

• Securonix researchers discovered the Smoke#Screen campaign, which uses fake Zoom and Adobe update prompts to trick victims into installing a remote-access tool criminals control.
• Once installed, the software is a legitimate, signed product called ScreenConnect, making it nearly invisible to standard antivirus or security scans.
• Attackers ran five separate attack chains and connected victims to three different relay servers they controlled.
• Researchers found the criminals accidentally left their own source code exposed on an open server, giving investigators an unusually clear view of how the operation was built.
• Both Windows and macOS computers are targeted.

A criminal hacking group has spent the last several months quietly taking over business computers using a clever trick: they get victims to install a genuine, trusted remote-support program called ScreenConnect, then use it to watch and control those computers from afar.

ScreenConnect is a real product made by ConnectWise. IT departments around the world use it to fix computers remotely, the same way a tech-support agent might "take over your screen" to help you. The criminals behind what researchers at Securonix are calling Smoke#Screen have turned that trusted tool into a weapon.

How did the hackers get in?

Victims were tricked through fake notifications disguised as routine software updates or document requests. The lures came in four flavours: fake Zoom updates, fake Adobe updates, a business document to review, and a fake system-maintenance tool called "SystemCheck."

Clicking any of them quietly installed ScreenConnect in the background. The victim's screen showed nothing alarming. Meanwhile, the criminals gained full, persistent access to the computer.

What made this harder to catch than usual: the attackers constantly swapped the malicious files between download attempts. Each time a new victim clicked, a slightly different version of the file arrived. Security tools that rely on recognising a specific file by its unique fingerprint, called a hash, never saw the same fingerprint twice.

Why couldn't security software catch it?

Because ScreenConnect is not malware. It carries a legitimate digital signature from ConnectWise, the company that built it. Nothing in the software itself is malicious.

"The payload isn't malware, and that's the whole problem," Aaron Beardslee, Securonix's manager of threat research, told Dark Reading. After installation, the process running on the victim's machine looks exactly like a properly authorised ConnectWise service doing its normal job, which just happens to include full remote desktop control.

Signature-based security tools, the kind that match known bad files against a database of threats, have no match to find. The attackers also routed their connections through Cloudflare tunnels, a service normally used by legitimate websites to stay fast and secure, to hide the true destination of the traffic.

What did researchers find when they looked closer?

A significant operational security mistake. The attackers left their own unfinished source code, the raw instructions used to build their tools, sitting in an open folder on the same server hosting their attack files. Securonix researchers could read it directly, no reverse-engineering required.

That exposed the full development history: features being added between versions, files reused under different names, and a layered evasion stack using Dropbox for reputation, Cloudflare for anonymity, and a genuine ConnectWise certificate on the final payload.

Researchers mapped five distinct attack chains and three separate ScreenConnect relay servers before the campaign was documented.

What should employees watch for?

If a browser window or a pop-up asks you to install or update software you did not deliberately go looking for, stop. Legitimate Zoom and Adobe updates arrive through the applications themselves, not through random prompts or email links.

Organisations can reduce exposure by setting Windows to its most cautious permission-prompt setting (called "Always notify" in User Account Control), and by configuring security software to flag any remote-support tool installed outside of the IT department's approved process. Behavioural monitoring, which watches what programs do rather than what they are, is the most reliable way to catch this kind of attack.