How a fake zoom update turned legitimate remote support tools into backdoors

I recently spent an afternoon reviewing a forensic image from a workstation belonging to a paralegal at a boutique law firm. The user was convinced she had simply updated her Zoom client to join a morning deposition. In reality, the file she executed was the starting point for SMOKE#SCREEN, a multi-wave campaign that turns authorized IT tools against the very networks they are meant to support. The user noticed nothing until a week later when her computer began acting as a jumping-off point for lateral movement across the internal server vlan.

This is the reality of modern social engineering. Attackers no longer need to write complex, custom backdoors when they can simply trick a user into installing a legitimate Remote Monitoring and Management (RMM) tool. By design, these tools have administrative privileges, bypass standard application whitelisting in many environments, and provide a stable connection to the outside world. Behind the scenes, the SMOKE#SCREEN campaign demonstrates a high level of operational maturity, shifting its delivery methods and evasion techniques to stay one step ahead of automated detection systems.

The anatomy of the smoke#screen infection chain

Researchers at Securonix recently identified this campaign, which uses lures ranging from Adobe and Zoom updates to business document reviews. The attack typically begins with a spear-phishing email containing an obfuscated Visual Basic Script (VBScript) dropper. I analyzed a similar sample last month and the level of paranoia in the code is impressive. Before it does anything else, the script performs a series of environment checks to see if it is running in a sandbox or being monitored by a security researcher.

It specifically looks for processes like Wireshark, Process Monitor, and various virtual machine services such as VMware and VirtualBox. If it detects any of these, it immediately terminates. Proactively speaking, this prevents the script from revealing its true intent to automated malware analysis platforms. Once it determines the coast is clear, the script decrypts a PowerShell command. This command connects to a staging server at 207.189.11[.]170 to fetch a C# payload.

From a risk perspective, the cleverness lies in what happens next. The payload does not install a virus in the traditional sense. Instead, it installs a ConnectWise ScreenConnect agent. This is a legitimate tool used by IT departments worldwide. Because the agent is signed and reputable, it often bypasses basic antivirus checks. Once installed, the agent beacons out to an attacker-controlled relay server on port 8041, giving the operator full remote desktop access to the victim's machine.

Why attackers choose remote monitoring and management tools

Using RMM tools like ScreenConnect is a de facto standard for modern threat actors. It solves the problem of persistence. If an attacker uses a custom trojan, a single signature update might kill their access. If they use a legitimate RMM tool, they blend in with authorized IT activity. Most Security Operations Centers (SOCs) see ScreenConnect traffic every day, so a single extra connection to a new relay server might not trigger an alarm.

In one variant of the SMOKE#SCREEN campaign, the attackers use a batch script to aggressively dismantle local defenses before the installation. The script attempts to disable the Windows Antimalware Scan Interface (AMSI), modifies the registry to turn off SmartScreen protections, and even removes the Zone.Identifier alternate data stream from the downloaded installer. This last step is significant because it removes the "Mark of the Web," a security feature that tells Windows a file originated from the internet. By removing this mark, the attacker prevents certain security prompts from appearing when the MSI file runs.

Evading detection with cloud tunnels and trusted platforms

One of the most interesting aspects of this campaign is how it hides its infrastructure. The actors have rotated their delivery strategy across multiple trusted hosting services. For example, they have used Dropbox shared links to host their initial payloads. Since Dropbox is an allow-listed domain in almost every corporate environment, the download rarely triggers a web filter block.

More recently, the attackers have started using Cloudflare Quick Tunnels. This service allows a user to expose a local server to the internet temporarily without a static IP or a registered domain. The staging server runs a Cloudflare binary to generate ephemeral tunnels with names like "subscription-magnetic-recommended-meat.trycloudflare.com." Because these URLs are temporary and associated with a trusted provider, they are nearly impossible to block based on reputation alone. Consequently, the attacker has a stealthy, short-lived path to deliver their malicious binaries and maintain command-and-control (C2) over the infected fleet.

From business lures to gaming cheats

The SMOKE#SCREEN campaign is not the only threat using this strategy. A separate campaign, recently documented by Bitdefender, targets a completely different demographic: gamers. This activity involves fake Xeno Roblox cheats and "executors" promoted on Discord and gaming forums. While the legal professional at a law firm is worried about a Zoom update, a teenager is looking for an advantage in a video game. The result is the same: a compromised system.

The lure here is a fake Xeno Executor installer. When the user runs the executable, it initiates a multi-stage Java-based infection. The final payload is a stealer named Powercat. This malware is a swiss army knife for data theft. It checks for a Java Runtime Environment, and if one is missing, it simply extracts its own. It then reads a local image file named "XenoIcon.jpg" to find the keys needed to communicate with its C2 server at solthere[.]net.

The powercat stealer and the theft of digital identities

Powercat is more than a simple credential harvester. It is a surveillance tool that provides attackers with a complete picture of the victim's digital life. It specifically targets web browsers like Chrome and Brave, cryptocurrency wallets like Atomic and Exodus, and even developer tools like Git and Visual Studio.

For users of the Exodus cryptocurrency wallet, the malware goes a step further. It checks if version 26.1.5 is installed, and if so, it unpacks the application's internal files to inject malicious JavaScript. This allows the attacker to capture session tokens directly. The malware also records keystrokes, takes screenshots, accesses the webcam, and streams the desktop in real-time. This level of access is a digital hostage situation. The attacker is not just stealing a password; they are sitting at the virtual desk with the user.

In my own testing of Java-based stealers, I have seen how difficult they are to detect using standard file-based scanning. Because the malicious logic is inside an obfuscated JAR file, and that JAR file is often run by a legitimate Java process, the activity looks like normal software execution to the operating system. This is why gaming-related lures remain so effective. They exploit the user's desire for functionality and their willingness to disable security software to get a "cheat" to work.

Practical takeaways for defense

Assessing the attack surface for these campaigns reveals that the human firewall is the first point of failure. However, technical controls must provide a backstop. Organizations and individuals should adopt a zero-trust mindset where every software update or utility is treated as suspicious until verified.

• Restrict MSI execution: Standard users should not be able to run MSI installers without administrative approval. Use AppLocker or Windows Defender Application Control (WDAC) to enforce this.
• Monitor RMM tools: Audit your environment for all RMM agents. If your IT department uses TeamViewer, any instance of ScreenConnect or AnyDesk is a high-priority alert.
• Audit PowerShell and CMD: Monitor for suspicious command-line arguments, especially those involving "encodedcommand" or attempts to bypass AMSI and modify the registry.
• Enforce strict UAC: Ensure that User Account Control is set to the highest level. This prevents malware from silently escalating privileges without the user noticing a prompt.
• Block Cloudflare Tunnels: Unless your business specifically requires them, consider blocking the trycloudflare.com domain at the network perimeter to prevent attackers from using ephemeral tunnels for C2.

Key mitigation checklist

Addressing these threats requires moving beyond a reactive stance. Patching aside, the real battle is over what is allowed to run on the endpoint. If you allow any signed binary to execute and communicate with the internet, you are essentially leaving the door unlocked for any actor who can find a legitimate tool to abuse.

Sources: Securonix SMOKE#SCREEN Report, Bitdefender Powercat Analysis, MITRE ATT&CK Framework, NIST Special Publication 800-207 (Zero Trust Architecture).

Disclaimer: This article is for informational and educational purposes only and does not replace a professional cybersecurity audit or incident response service.