Fake Zoom update malware campaign expands its reach to macOS

A malware campaign is using fake Zoom updates and business files to install ScreenConnect, giving attackers remote control through software that can resemble legitimate IT activity. And now, it's come to Mac.

Securonix researchers detailed the campaign, named Smoke#Screen, in an August 4 report. They traced Windows scripts, compiled loaders, an HTML phishing page and a macOS package named "ZoomUpdateInstaller.pkg" to shared infrastructure.

ScreenConnect is legitimate remote monitoring and management software published by ConnectWise and commonly used by IT departments. The campaign configures genuine ScreenConnect clients to contact attacker-controlled relay servers rather than an authorized company system.

Once connected, the software can give an attacker remote desktop and management capabilities. The resulting activity may resemble ordinary technical support, making the intrusion harder to identify without examining how the software arrived and where it connects.

The macOS package contacted the same primary relay server as several Windows payloads, tying it to the wider operation. However, Securonix did not identify how the Mac installer was distributed or report any confirmed Mac infections.

The report also didn't say whether the macOS package was signed and notarized by Apple. The discovery therefore establishes that the campaign's infrastructure included a Mac payload, but not that attackers successfully delivered it to Mac users.

The finding adds to a series of campaigns using fake installers and familiar software brands to persuade Mac users to run malware. In this case, the strongest evidence of completed infection chains comes from the Windows payloads analyzed by Securonix.

Fake updates lead to ScreenConnect

Securonix documented four social engineering themes involving Zoom updates, Adobe updates, business document reviews and system maintenance checks. Each observed attack path tried to persuade the victim to open a file that installed ScreenConnect.

The investigation began with a Windows VBScript file named "zoom-update.vbs" that appeared in Securonix telemetry. Researchers followed its network activity to an accessible staging server containing 15 payloads, including the macOS Zoom installer.

Other files included ScreenConnect installers named "SystemCheck.msi" and "Document-review.msi." The server also hosted Windows executables posing as Adobe Reader updates and document viewers.

The files used different names and delivery methods, but they served the same purpose. Each installed an unauthorized ScreenConnect client configured to contact attacker infrastructure.

Researchers identified three ScreenConnect relay clusters, each using a separate RSA key pair. The primary server also hosted the campaign's payloads, allowing it to distribute files and manage infected computers.

Other parts of the campaign used Dropbox and a Cloudflare Quick Tunnel to deliver payloads or conceal supporting infrastructure. Downloads involving familiar cloud services may attract less attention than traffic from an unknown domain, although security tools can still detect suspicious commands and installations.

Separate relay servers could also make the campaign more difficult to disrupt. Identifying or shutting down one cluster would not disable clients configured to contact the others.

Windows loaders attack security defenses

The Windows samples show that the campaign changed its methods during Securonix's investigation. Initial loaders relied on obfuscated VBScript, encrypted commands and environmental checks intended to complicate automated analysis.

One script stopped running when it found less than 2 GB of physical memory, a condition associated with some lightweight virtual machines and malware sandboxes. It also searched for Wireshark, Process Monitor, VirtualBox services and VMware Tools before continuing.

Other loaders used batch files and compiled .NET programs to attack Windows security controls before installing ScreenConnect. The commands attempted to disable Microsoft Defender protections, change SmartScreen settings and add antivirus exclusions.

The loaders also tried to remove Mark of the Web data from downloaded files. Windows uses that marker to identify files obtained from the internet and apply additional security warnings.

One loader added the root of the C: drive to Microsoft Defender's exclusion list. It also attempted to change the Windows Defender service's startup configuration.

Securonix said the sequence could leave a computer with weakened protections even if the later ScreenConnect download failed. The broad exclusion could also make it easier for additional malware to avoid antivirus scanning.

The campaign later changed direction. Researchers found a newer loader that removed the aggressive Defender-tampering sequence and instead waited three minutes between installing ScreenConnect and starting its service.

The delay appeared designed to separate related events inside endpoint detection logs. Securonix also found a source-code comment that referred specifically to breaking Elastic event correlation.

The finding supports the researchers' conclusion that the operators adjusted their tools in response to commercial security products. However, the report does not establish when each loader entered circulation or whether all versions were used sequentially.

The analyzed Windows attack paths ultimately installed legitimate ScreenConnect MSI packages signed by ConnectWise through a valid DigiCert certificate chain. Signed remote-management software may receive less scrutiny than an unknown executable, although a valid signature does not make an unauthorized installation safe.

Attackers have used similar remote access capabilities in previous Mac malware campaigns because they provide continuing control without requiring a custom backdoor. Smoke#Screen instead deploys a genuine enterprise management client that may already be familiar to corporate security teams.

The report does not identify the people operating Smoke#Screen or connect the campaign to a known hacking group. Shared servers, encryption keys and payload development link the analyzed files, but they do not reveal the operators' identity, location or motive.

How Mac users can stay safe from Smoke#Screen

The attack paths documented by Securonix required a victim to open a file presented as an update, document or maintenance utility. Software such as Zoom and Adobe Reader should be updated through built-in tools or installers downloaded directly from the developer.

Mac users should treat unexpected installer packages as suspicious, even when the filename refers to familiar software. Previous campaigns have shown that signed or even notarized apps can still begin a malicious installation.

Organizations should inventory approved remote management tools and identify ScreenConnect agents that contact unknown servers or raw IP addresses. Defenders should also examine how the software arrived, which process launched it and whether the installation was authorized.

The ScreenConnect name and its valid digital signature are not enough to establish that an installation is safe. The relay destination and surrounding activity provide the context needed to separate approved support software from an attacker's remote-access tool.