Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business document reviews, and system maintenance utilities to stealthily deploy Remote Monitoring and Management (RMM) programs like ConnectWise ScreenConnect.
The campaign has been codenamed SMOKE#SCREEN by Securonix Threat Research.
“The campaign relies on a toolkit of VBScript droppers, batch file loaders, compiled .NET executables and an HTML phishing page, all ultimately pointing to a live WsgiDAV-based staging server at 207.174.0[.]143:8080,” researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee said in a report shared with The Hacker News.
Successful attacks culminate with a ScreenConnect agent installed and beaconing to one of three attacker-controlled relay servers, providing the attackers with persistent remote access to compromised systems. The activity has not been attributed to any known threat actor or group.
The findings add to the growing abuse of legitimate RMM tools by threat actors, as it allows them to bypass security controls and take advantage of their prevalence in enterprise environments to blend in with authorized IT tooling without the need for deploying a purpose-built remote access trojan.
Securonix said its investigation commenced following the discovery of a live WsgiDAV server that served two purposes: stage malicious payloads and maintain command-and-control (C2) over existing infected machines through a ScreenConnect relay on port 8041.
An analysis of the ScreenConnect relay configuration strings embedded in the MSI and EXE payloads has uncovered three distinct C2 clusters, each associated with software update, document review, and document viewer decoy binaries.
The initial access vector is assessed to be spear-phishing, with the emails serving as a conduit for an obfuscated Visual Basic Script (aka VBScript) dropper that first performs a series of environment and anti-analysis checks to ensure safe execution. It also enumerates running processes, and aborts if any of the following executables are running –
- Wireshark (wireshark.exe)
- Process Monitor (procmon.exe)
- Oracle VM VirtualBox (vboxservice.exe)
- Broadcom VMware Tools (vmtoolsd.exe)
- Citrix XenServer (xenservice.exe)
- Fiddler Classic (fiddler.exe)
If the environment checks pass, the script proceeds to decrypt a PowerShell command that fetches a C# payload from “207.189.11[.]170” and executes it. Alternatively, attacks have been observed using business-themed lures to trick recipients into running a VBScript that ultimately leads to ScreenConnect installation.
A third sample linked to the activity is delivered as a compressed archive, from which a batch script is run to disable Windows Antimalware Scan Interface (AMSI), escalate privileges by means of a User Account Control (UAC) prompt, turn off SmartScreen protections via Registry modifications, and then remove the Zone.Identifier alternate data stream (ADS) from the downloaded MSI file before running it.
“The actor’s delivery strategy has also rotated across multiple trusted hosting services,” Securonix said. “An early phishing page (‘zoom-update.html’) delivers its payload via a Dropbox shared link, bypassing domain reputation filters since Dropbox is an allow-listed platform in most corporate environments.”
“A compiled .NET loader (‘MemoryLoader.cs’) references a Cloudflare Quick Tunnel (subscription-magnetic-recommended-meat.trycloudflare.com), a service designed for temporary local server exposure that is rarely monitored. The staging server itself runs cloudflared.exe, confirming that the actor uses the Cloudflare binary directly on their infrastructure to generate these ephemeral tunnels.”
Irrespective of the phishing lure used, all attack paths lead to the same destination: the installation of ScreenConnect client, which connects to a configured relay server and allows the operator to open a remote desktop session with the victim’s machine.
“What makes this campaign particularly notable for defenders is the observable arc of the actor’s tradecraft,” Securonix said. “From cautious XOR-encrypted VBScript droppers to aggressive nine-step Defender destruction sequences and then, most recently, a pivot back to stealth with anti-EDR timing and self-contained encrypted bundles, the campaign reads like a real-time arms race between attacker and defender.”
To counter the threat, organizations are recommended to restrict execution of untrusted MSI files, monitor when processes attempt to tamper with security products, audit legitimate use of RMM tools, check for suspicious PowerShell and “cmd.exe” processes, and enforce strict UAC settings to prevent standard users from bypassing UAC prompts for administrative tasks.
Fake Xeno Roblox Cheats Deliver Java Stealer Malware
The disclosure comes as Bitdefender warned of a separate campaign in which fake Xeno Executor installers promoted via gaming forums and Discord communities are used to initiate a multi-stage Java infection chain that drops an information stealer capable of credential theft, as well as stealing browser cookies, Discord, Roblox and Minecraft accounts, cryptocurrency-wallet data and payment information.
The stealer, named Powercat, can also record keystrokes, access the webcam, stream the victim’s desktop, manipulate files, run PowerShell commands, and grant attackers interactive control of the infected computer.
“The final payload combines information theft, surveillance, persistence, remote access, file manipulation and command execution,” Bitdefender researchers Janos Gergo Szeles and Silviu Stahie said.
The activity is believed to have been ongoing since the start of 2026, with a surge recorded in the second half of March. Some aspects of the campaign were previously documented by ThreatLocker in late March 2026, highlighting the threat actor’s use of bogus cheats for popular PC games to distribute Powercat.
The so-called cheats come in the form of archives that mimic a legitimate Xeno installation using plausible file names. Victims are instructed to run a “xeno.exe,” which, instead of launching the cheat, runs the first stage of the malware.
The payload checks for a Java Runtime Environment, extracts one if missing, and then reads a local file (“XenoIcon.jpg”) containing the keys necessary to validate its execution with the C2 server (“solthere[.]net”). Subsequently, it launches an obfuscated JAR file disguised as “decompiler.exe,” which performs environment checks, registers the victim, and downloads the final malware payload.
The third stage is a Java-based stealer and surveillance malware that can harvest sensitive data, collect screenshots and webcam footage, stream the victim’s desktop, and monitor keyboard and mouse activity. It can also download and upload files, execute commands through PowerShell, and open an interactive shell for hands-on-keyboard access, giving the attacker full control over the host.
“Personal information theft begins with the malware gathering information about potentially interesting software installed on the victim’s system,” Bitdefender said. “This allows the operators to adapt their strategy and prioritize which data to steal.”
Targeted applications include –
- Web browsers (Brave Browser, Chrome, Edge, Opera, Opera GX, and Vivaldi)
- Cryptocurrency wallets (Atomic, Cake Wallet, Exodus, Monero Wallet, SafePal, and Tron Wallet)
- Software development tools (Git, JetBrains tools, Microsoft Visual Studio, and Python IDLE)
- Game launchers (Battle.net, Epic Games Launcher, Riot Client, Rockstar Games Launcher, and Steam)
- VPN (ExpressVPN, Mullvad VPN, NordVPN, and Surfshark)
- Messengers (Discord, Snapchat, Telegram, and WhatsApp)
- Roblox and Minecraft installations (Feather, Lunar, Meteor, Modrinth, Prism, and the official Minecraft launcher)
To target Exodus cryptocurrency wallets, the stealer checks if Exodus version 26.1.5 is installed on the system, and, if so, unpacks the “app.asar” archive and injects JavaScript code to capture valid tokens and exfiltrate them to the C2 server.
“Gaming-related lures remain effective because they exploit users’ interest in gaining an advantage, accessing restricted functionality, or avoiding anti-cheat detection,” Bitdefender said.
“The delivered malware is considerably more capable than a typical credential stealer. Its remote-access and command-execution capabilities also mean that the compromise can continue beyond the initial theft of information, which can lead to data destruction or allow operators to use the infected system in other cyber-criminal activities.”
