Fake Zoom update malware campaign expands to macOS

A recent malware campaign exploits fake Zoom and enterprise files to install ScreenConnect, offering attackers remote control through software that can look like legitimate IT activity. This campaign, dubbed Smoke#Screen, has now expanded to macOS, causing concern among users of the traditionally more secure platform.

See also: BlueNoroff distributes MacOS malware via deepfake videos in Zoom meetings

Researchers at Securonix analyzed the campaign and published their findings in a report on August 4. The Smoke#Screen campaign uses a number of techniques to achieve its goals. Attackers exploit fake Zoom updates that look like genuine ones to trick users into installing the malware. ScreenConnect, which is legitimate remote monitoring and management software published by ConnectWise, is commonly used by IT departments for system support and management.

However, in this case, attackers configure authentic ScreenConnect clients to communicate with relay servers controlled by them, instead of an authorized company system.

This process allows attackers to gain remote desktop and management capabilities, giving them essentially complete control over the victim’s system. The resulting activity can look like regular technical support, making the intrusion more difficult to detect without examining how the software arrived and where it connects. This feature makes the campaign particularly dangerous, as attackers can remain undetected for long periods of time.

See also: Zoom Security Update – Fixing Multiple Vulnerabilities

This campaign highlights the increasing sophistication of attacks targeting platforms like macOS. Despite the traditional perception that macOS is more secure than other platforms, attackers are constantly finding new ways to bypass security measures. Users are urged to be extra cautious with software updates and verify the authenticity of files before installation.

Using trusted sources to download updates and regularly monitoring system activity can help prevent such attacks.

Additionally, educating users about phishing techniques and strengthening security protocols can reduce the risk of a successful attack. Companies should review their security policies and ensure that employees are up to date on the latest threats. Working with security experts to develop detection and response strategies can be critical to protecting systems from such sophisticated attacks.

See also: Fake sites Zenmap and WinMTR distribute Bumblebee malware

The Smoke#Screen campaign is a clear indication that attacks continue to evolve, and constant vigilance and adaptation to new threats are essential for the security of digital infrastructure. Users and organizations must be prepared to face such challenges by adopting preventive measures and strengthening their security procedures. Understanding the methods used by attackers and staying informed about the latest developments in cybersecurity is critical to preventing and responding to threats.