Social Engineering

SMOKE#SCREEN Campaign Uses Fake Updates to Install ScreenConnect and Give Attackers Remote Access

Securonix researchers warn the operation uses legitimate signed RMM installers and trusted hosting to route infected agents to attacker-controlled relay servers and evade detection.