Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT tooling. A separate campaign also uses fake “Xeno” Roblox cheat installers promoted on Discord/forums to deliver a powerful Java-based information stealer.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “Zoom Update Required, Please Install the Latest Version.” Looks routine, right? You click. A “zoom-update.html” page opens from a Dropbox link, downloads an installer… but instead of Zoom, it quietly installs ScreenConnect so someone can sit on your machine like IT. Same trick with “Document Review Needed” emails that tell you to run a .vbs script. Different lure, same endgame: a ScreenConnect agent sitting there, giving persistent remote access. If an email or chat tells you to update software or run a script, don’t click it, open the app or vendor website yourself, and if it still seems off, send it to IT.
Researchers describe an active campaign ("SMOKE#SCREEN") where attackers trick users with realistic software update and document-themed lures to install a legitimate remote-control tool (ScreenConnect). Once installed, the attacker gains persistent remote access that can look like normal IT…
Researchers report multiple real-world email phishing campaigns that used tax and government-benefit themes to trick people into downloading malware. The campaigns used a “crypter” service called Cruciferra to hide malicious files and help malware run while avoiding detection. Targets included…
Researchers linked DigiCert’s April 2026 breach to a GoldenEyeDog sub-group that tricked support staff into running a malicious file delivered through a customer support chat. The attackers then abused DigiCert’s support portal features to intercept EV code-signing certificate “initialization…
Researchers reported an active PhantomEnigma campaign where attackers hijacked 20+ Brazilian government websites and used them as trusted stepping-stones to deliver malware. The lure used official-looking police-themed documents (sometimes with QR codes) and emails that could pass common email…
Researchers reported a real phishing campaign (“Operation BlueDash”) that tricks users with a “secure document” lure and routes them to a fake Microsoft Store page that claims Microsoft Teams must be updated. The download installs legitimate remote access tools (Level RMM and ScreenConnect) so…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
