Securonix Threat Research: Fake Zoom update malware has come to the Mac

Securonix Threat Research has been tracking an active, multi-wave campaign the company is calling SMOKE#SCREEN that’s come to the Mac. In the campaign, threat actors use a rotating collection of social engineering lures themed around Zoom software updates, business document reviews, and system maintenance utilities to deliver silent ScreenConnect Remote Monitoring and Management (RMM) agent installations. Here’s some (very technical info) from Securonix Threat Research: The campaign relies on a toolkit of VBScript droppers, batch file loaders, compiled .NET executables and a HTML phishing page, all ultimately pointing to a live WsgiDAV-based staging server at 207.174.0.143:8080. Software such as Zoom and Adobe Reader should be updated through built-in tools or installers downloaded directly from the developer. Almost all our income is from Patreon support and sponsored posts.