Cybersecurity researchers at **Securonix Threat Research** have unveiled details of an ongoing, multi-wave campaign codenamed **SMOKE#SCREEN**. This campaign meticulously employs social engineering, masquerading as **Adobe** and **Zoom** software updates, business document reviews, or system maintenance utilities to surreptitiously install Remote Monitoring and Management (RMM) programs like **ConnectWise ScreenConnect**. "The campaign relies on a toolkit of VBScript droppers, batch file loaders, compiled .NET executables and an HTML phishing page, all ultimately pointing to a live WsgiDAV-based staging server at 207.174.0[.]143:8080," stated **Shikha Sangwan**, **Akshay Gaikwad**, and **Aaron Beardslee** in a **Securonix** report. Successful incursions result in a **ScreenConnect** agent beaconing to one of three attacker-controlled relay servers, furnishing persistent remote access to compromised systems. The threat actor behind this activity remains unattributed to any known group.  ### The Allure of Legitimate RMM Tools This campaign underscores a growing trend where threat actors abuse legitimate RMM tools. Such an approach allows them to circumvent security measures and leverage the widespread presence of these tools in enterprise environments. This tactic helps them blend in with authorized IT infrastructure, eliminating the need for custom-built remote access trojans. **Securonix** initiated its investigation after discovering a live **WsgiDAV** server. This server served dual purposes: staging malicious payloads and maintaining command-and-control (C2) over infected machines via a **ScreenConnect** relay on port 8041. Analysis of **ScreenConnect** relay configuration strings embedded within MSI and EXE payloads revealed three distinct C2 clusters, each linked to specific decoy binaries for software updates, document reviews, and document viewers. ### Initial Access and Evasion Tactics The initial access vector is assessed to be spear-phishing. These emails deliver an obfuscated Visual Basic Script (**VBScript**) dropper that first conducts a series of environment and anti-analysis checks to ensure safe execution. It enumerates running processes and aborts if any of the following are detected: * **Wireshark** (wireshark.exe) * **Process Monitor** (procmon.exe) * **Oracle VM VirtualBox** (vboxservice.exe) * **Broadcom VMware Tools** (vmtoolsd.exe) * **Citrix XenServer** (xenservice.exe) * **Fiddler Classic** (fiddler.exe) Upon passing these checks, the script decrypts and executes a PowerShell command that fetches a C# payload from "207.189.11[.]170". Alternative attack paths have also been observed, employing business-themed lures to trick recipients into running a **VBScript** that ultimately installs **ScreenConnect**. A third sample, delivered as a compressed archive, utilizes a batch script to disable **Windows Antimalware Scan Interface (AMSI)**, escalate privileges via a **User Account Control (UAC)** prompt, turn off **SmartScreen** protections through Registry modifications, and remove the **Zone.Identifier** alternate data stream (ADS) from the downloaded MSI file before execution.  ### Evolving Delivery and Infrastructure "The actor's delivery strategy has also rotated across multiple trusted hosting services," **Securonix** noted. An early phishing page ('zoom-update.html') distributed its payload via a **Dropbox** shared link, leveraging the platform's allow-listed status to bypass domain reputation filters. A compiled .NET loader ('MemoryLoader.cs') references a **Cloudflare Quick Tunnel** (subscription-magnetic-recommended-meat.trycloudflare.com), a service designed for temporary local server exposure that is rarely monitored. The staging server itself runs `cloudflared.exe`, confirming the actor's direct use of the **Cloudflare** binary to generate these ephemeral tunnels. Regardless of the phishing lure, all attack paths converge on the installation of the **ScreenConnect** client, which connects to a configured relay server, enabling the attacker to establish a remote desktop session with the victim's machine. "What makes this campaign particularly notable for defenders is the observable arc of the actor's tradecraft," **Securonix** emphasized. "From cautious XOR-encrypted VBScript droppers to aggressive nine-step Defender destruction sequences and then, most recently, a pivot back to stealth with anti-EDR timing and self-contained encrypted bundles, the campaign reads like a real-time arms race between attacker and defender." ### Recommendations for Defense To mitigate this threat, organizations should: * Restrict the execution of untrusted MSI files. * Monitor processes attempting to tamper with security products. * Audit the legitimate use of RMM tools. * Check for suspicious PowerShell and `cmd.exe` processes. * Enforce strict **UAC** settings to prevent standard users from bypassing **UAC** prompts for administrative tasks. ### Separate Campaign: Fake Xeno Roblox Cheats Deliver Java Stealer Malware In a related disclosure, **Bitdefender** has issued a warning regarding a distinct campaign. This campaign utilizes fake **Xeno Executor** installers, promoted through gaming forums and **Discord** communities, to initiate a multi-stage Java infection chain. This chain ultimately deploys an information stealer, dubbed **Powercat**, capable of credential theft, as well as stealing browser cookies, **Discord**, **Roblox**, and **Minecraft** accounts, cryptocurrency-wallet data, and payment information.  **Powercat** can also record keystrokes, access webcams, stream the victim's desktop, manipulate files, run PowerShell commands, and grant attackers interactive control over the infected computer. "The final payload combines information theft, surveillance, persistence, remote access, file manipulation and command execution," stated **Bitdefender** researchers **Janos Gergo Szeles** and **Silviu Stahie**. This activity is believed to have been ongoing since early 2026, with a significant surge in the second half of March. **ThreatLocker** previously documented aspects of this campaign in late March 2026, highlighting the use of bogus cheats for popular PC games to distribute **Powercat**. The so-called cheats are delivered in archives mimicking legitimate **Xeno** installations with plausible file names. Victims are instructed to run "xeno.exe," which, instead of launching the cheat, initiates the first stage of the malware. The payload checks for a Java Runtime Environment, extracts one if missing, and then reads a local file ("XenoIcon.jpg") containing keys to validate its execution with the C2 server ("solthere[.]net"). Subsequently, it launches an obfuscated JAR file disguised as "decompiler.exe," which performs environment checks, registers the victim, and downloads the final malware payload. The third stage is a Java-based stealer and surveillance malware that harvests sensitive data, collects screenshots and webcam footage, streams the victim's desktop, and monitors keyboard and mouse activity. It can also download and upload files, execute commands via PowerShell, and open an interactive shell for hands-on-keyboard access, granting attackers full control over the host. "Personal information theft begins with the malware gathering information about potentially interesting software installed on the victim's system," **Bitdefender** explained. "This allows the operators to adapt their strategy and prioritize which data to steal." Targeted applications include: * Web browsers (**Brave Browser**, **Chrome**, **Edge**, **Opera**, **Opera GX**, and **Vivaldi**) * Cryptocurrency wallets (**Atomic**, **Cake Wallet**, **Exodus**, **Monero Wallet**, **SafePal**, and **Tron Wallet**) * Software development tools (**Git**, **JetBrains** tools, **Microsoft Visual Studio**, and **Python IDLE**) * Game launchers (**Battle.net**)