2026-08-08NOTABLEInteractive fake-update modals, cloud-hosted payloads and self-registering RMM installers deployed at guest permission to stay quiet
ScreenConnect app-store-themed fake-update distribution campaign
campaign · campaign:screenconnect-appstore-phishing-2026-08 single-source
Large-scale ConnectWise ScreenConnect distribution campaign documented by LevelBlue SpiderLabs (2026-08-07). Impersonates the Google Meet pre-join screen, the Microsoft Store and the Apple App Store with interactive modal update dialogs, delivers a batch-to-PowerShell-to-MSI silent install, and binds each installer by embedded public key to a specific attacker-controlled ScreenConnect relay so it self-registers on install at guest-level permission. Payloads are hosted on AWS S3 and Cloudflare R2 behind anti-automation gating and victim fingerprinting, with operator notification via the Telegram Bot API.
Coverage
1
first 2026-08-08 → last 2026-08-08
Latest activity
2026-08-08
Interactive fake-update modals, cloud-hosted payloads and self-registering RMM installers deployed at guest…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, healthcare, finance
Sources cited
1
1 hosts
Action items (1)
Do-now tasks recorded on the entries about ScreenConnect app-store-themed fake-update distribution campaign, newest first. Check the date before acting on an older one.
- Alert on ScreenConnect client installation where the relay hostname is not one your organisation operates, the campaign's installers self-register to an attacker relay on install, so the relay identity is the discriminator that survives every cosmetic change to the lure.2026-08-08Interactive fake-update modals, cloud-hosted…
Defender insights
What each entry about ScreenConnect app-store-themed fake-update distribution campaign tells a defender to do, newest first.
Triage
Story timeline
ATT&CK techniques (5 across 4 tactics)
5 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)
- Resource DevelopmentAcquire Infrastructure: Web Services
- Initial AccessDrive-by Compromise
- ExecutionUser Execution: Malicious File
- Command and ControlWeb Service: Bidirectional Communication · Remote Access Tools
Resource Development TA0042
T1583.006Acquire Infrastructure: Web Services×1
Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.
Evidence: 2026-08-08/screenconnect-app-store-fake-update-distribution-campaign · ATT&CK page ↗
Initial Access TA0001
T1189Drive-by Compromise×1
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:
Evidence: 2026-08-08/screenconnect-app-store-fake-update-distribution-campaign · ATT&CK page ↗
Execution TA0002
T1204.002User Execution: Malicious File×1
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.
Evidence: 2026-08-08/screenconnect-app-store-fake-update-distribution-campaign · ATT&CK page ↗
Command and Control TA0011
T1102.002Web Service: Bidirectional Communication×1
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.
Evidence: 2026-08-08/screenconnect-app-store-fake-update-distribution-campaign · ATT&CK page ↗
T1219Remote Access Tools×1
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
Evidence: 2026-08-08/screenconnect-app-store-fake-update-distribution-campaign · ATT&CK page ↗
Entries about ScreenConnect app-store-themed fake-update distribution campaign (1)
Co-occurring entities
Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.
Where this entity is cited
Source distribution
- levelblue.com1 (100%)