When members of your organization log into their computers, they likely expect to receive the occasional software update from trusted services and documents from colleagues. Unfortunately, cybercriminals have found ways to exploit that expectation.
Security experts from Securonix Threat Research have recently uncovered a ruse to deliver malware to unsuspecting users through fake updates and maintenance tools. The Adobe updates malware can give attackers access to victims’ devices while using techniques designed to evade security protections.
What Happened?
This social engineering campaign, codenamed SMOKE#SCREEN, uses a toolkit of VBScript droppers and an HTML phishing page, along with batch file loaders and multiple .NET executables for malware installation. The hackers trick people into downloading malicious files using the following lures:
- Fake Adobe updates
- Fake Zoom updates
- Fake system maintenance utilities
- Fake business document reviews
To convince users that the files and updates were genuine, the attackers used familiar software names. For example, one file was named “AdobeReader_Update.exe,” and another was simply “SystemCheck,” but neither was legitimate.
Because the updates and reviews appear authentic, victims may unknowingly install the malware on their devices. Once the malware is installed, it deploys ConnectWise ScreenConnect, a legitimate Remote Monitoring and Management tool that many IT teams use to access work computers remotely. In this campaign, the ScreenConnect deployment connects the compromised device to attacker-controlled infrastructure.
How Malware Escaped Detection
The fake Adobe updates malware was designed to hide in plain sight. The hackers created phishing pages with the same logos and brand colors as legitimate platforms to appear authentic. These malicious websites used JavaScript to trigger an automatic download with fake progress bars while prompting users to run the update.
Rather than getting a real update, users received a malware installer through trusted services such as Dropbox or Cloudflare, which helped make the malicious activity harder to detect. Older versions of this attack hid the activity, but the campaign has evolved.
Earlier versions of the malware attempted to disable security protections to evade detection. Updated code can use a three-minute delay before triggering the installed service to evade endpoint detection.
The attackers also rely on legitimate ScreenConnect installers that are digitally signed with a trusted DigiCert certificate. Because of that trusted certificate, some security tools may not treat them as suspicious.
Who’s Responsible for the Problem?
Unfortunately, the fake Adobe updates malware campaign has not been attributed to any known threat actor or group. The campaign has targeted both macOS and Windows devices used by various organizations. The threat actors appear capable and adaptive, using trusted services and evolving tactics to exploit legitimate ScreenConnect deployments and evade security protections.
How You Can Protect Your Business From Fake Software Updates
According to Securonix, organizations should restrict the execution of untrusted MSI installers using Windows Defender Application Control or another application control technology. Watch for attempts to disable or modify Microsoft Defender on company computers, since such behavior can indicate malicious activity, including the installation of fake Adobe updates malware.
