A malware campaign is using fake Zoom updates and business files to install ScreenConnect, giving attackers remote control through software that can resemble legitimate IT activity. The macOS package contacted the same primary relay server as several Windows payloads, tying it to the wider operation. The files used different names and delivery methods, but they served the same purpose. Other parts of the campaign used Dropbox and a Cloudflare Quick Tunnel to deliver payloads or conceal supporting infrastructure. Downloads involving familiar cloud services may attract less attention than traffic from an unknown domain, although security tools can still detect suspicious commands and installations.