Researchers at Securonix have uncovered an active multi-wave campaign dubbed SMOKE#SCREEN, in which attackers use phishing lures — fake Adobe and Zoom updates, business document viewing, maintenance utilities — to covertly install the legitimate remote monitoring tool ConnectWise ScreenConnect. The attack culminates in the installation of an agent that connects to one of three relay servers and gives operators full remote access to the compromised machine. In parallel, Bitdefender reported on a campaign using fake Roblox cheats to distribute the multifunctional stealer Powercat. Both campaigns demonstrate a trend toward abusing trusted tools and platforms to bypass security controls.
Technical anatomy of SMOKE#SCREEN
According to Securonix, the campaign’s infrastructure is built around a WsgiDAV-based server that simultaneously acts as an intermediate storage site for malicious payloads and as a command center via a ScreenConnect relay on port 8041. Analysis of ScreenConnect configuration strings embedded in MSI and EXE files revealed three separate management clusters, each tied to a specific type of lure: software updates, document viewing, and document-handling applications.
The presumed initial access vector is targeted phishing. Researchers observed several parallel infection chains:
- VBScript dropper: an obfuscated script delivered via a phishing email performs a series of runtime environment checks and looks for running analysis tools — Wireshark, Process Monitor, Fiddler Classic — as well as signs of virtualization (VirtualBox, VMware Tools, Xen). If any of these are detected, execution stops. If the checks are passed, the script decrypts a PowerShell command that downloads a C# payload from an external server.
- Business-themed lures: an alternative path where the victim is prompted to run a VBScript under the pretext of viewing a business document, which likewise results in ScreenConnect being installed.
- Archive with a batch script: a third delivery option is a compressed archive from which a batch file is launched. It sequentially disables AMSI, requests privilege escalation via UAC, deactivates SmartScreen through the registry, and removes the Zone.Identifier alternate data stream from the downloaded MSI file before executing it.
Abuse of trusted services
The operators’ infrastructure tactics merit special attention. An early phishing page, zoom-update.html, delivered the payload via a shared Dropbox link — a platform that is typically whitelisted in corporate environments. The compiled .NET loader (MemoryLoader.cs) connects to an ephemeral Cloudflare Quick Tunnel, and the intermediate server itself was found running cloudflared.exe, confirming the direct use of Cloudflare infrastructure to generate temporary tunnels. Such tunnels are rarely monitored by corporate security tools, making them an attractive channel for attackers.
Regardless of the infection path chosen, the end result is the same — an installed ScreenConnect client connected to a relay server and giving the operator a remote desktop session on the victim’s machine.
Indicators of compromise
According to the research, the following network indicators were observed:
- IP addresses of intermediate servers: 207.174.0[.]143, 207.189.11[.]170
- Cloudflare tunnel domain: subscription-magnetic-recommended-meat.trycloudflare[.]com
Parallel threat: Powercat stealer via fake cheats
At the same time, Bitdefender warned about an independent campaign targeting gamers. Fake Xeno Executor installers for Roblox, distributed through gaming forums and Discord communities, launch a multi-stage Java-based infection chain that ultimately installs the Powercat stealer.
The victim is prompted to run xeno.exe, which, instead of a cheat, initiates the first stage of the malicious code. The payload checks for the presence of the Java Runtime Environment (and, if absent, extracts its own copy), reads validation keys from the local file XenoIcon.jpg to communicate with the C2 server solthere[.]net, and then launches an obfuscated JAR file disguised as decompiler.exe.
As previously documented by ThreatLocker researchers, Powercat significantly surpasses a typical credential stealer. Its capabilities include:
- Stealing data from browsers (Brave, Chrome, Edge, Opera, Opera GX, Vivaldi), cryptocurrency wallets (Atomic, Cake Wallet, Exodus, Monero Wallet, SafePal, Tron Wallet), messengers (Discord, Telegram, WhatsApp, Snapchat)
- Capturing screenshots and webcam video, streaming the desktop
- Logging keyboard input and mouse activity
- Executing PowerShell commands and providing interactive command shell access
- Uploading and downloading files
For attacks on Exodus wallets, the stealer, according to researchers, checks for version 26.1.5, unpacks the app.asar archive, and injects JavaScript code to intercept tokens and exfiltrate them to the C2 server. The campaign has reportedly been active since early 2026, with a spike in the second half of March.
Impact assessment
The SMOKE#SCREEN campaign poses a threat primarily to corporate environments, where RMM tools are a standard part of IT infrastructure. The installed ScreenConnect agent is visually indistinguishable from a legitimate one, which makes detection extremely difficult. Attribution of the campaign remains undetermined — none of the known threat actors have been linked to this activity.
Powercat, in turn, targets individual users — primarily a younger audience interested in game cheats. However, the breadth of data collected (from crypto wallets to development tools and VPN clients) and its remote-control capabilities turn every compromised machine into a foothold for further attacks.
Security recommendations
To counter SMOKE#SCREEN:
- Restrict execution of MSI files from untrusted sources via AppLocker or WDAC policies
- Monitor processes attempting to disable AMSI or SmartScreen or modify registry keys related to Windows Defender
- Audit all installed instances of RMM tools and compare them against authorized deployments
- Track suspicious child processes of cmd.exe and powershell.exe, especially those with obfuscated arguments
- Harden UAC settings to prevent standard users from bypassing prompts
- Block or monitor access to trycloudflare.com domains and the IP addresses listed above
To protect against Powercat:
- Block execution of unsigned JAR files and executables from temporary directories
- Educate users about the risks of downloading game cheats and mods from unofficial sources
- Monitor network connections to the solthere[.]net domain
Both campaigns share a common principle: instead of building their own remote-access tools, attackers exploit legitimate software and trusted platforms — ConnectWise ScreenConnect, Dropbox, Cloudflare. The key action for security teams is an immediate audit of all RMM agents in the infrastructure, verifying each instance against the registry of authorized installations, as well as implementing detection rules for attempts to disable AMSI and SmartScreen.
