ctipilot.ch

ScreenConnect app-store-themed fake-update distribution campaign

campaign · campaign:screenconnect-appstore-phishing-2026-08 single-source

Large-scale ConnectWise ScreenConnect distribution campaign documented by LevelBlue SpiderLabs (2026-08-07). Impersonates the Google Meet pre-join screen, the Microsoft Store and the Apple App Store with interactive modal update dialogs, delivers a batch-to-PowerShell-to-MSI silent install, and binds each installer by embedded public key to a specific attacker-controlled ScreenConnect relay so it self-registers on install at guest-level permission. Payloads are hosted on AWS S3 and Cloudflare R2 behind anti-automation gating and victim fingerprinting, with operator notification via the Telegram Bot API.

Coverage timeline
1
first 2026-08-08 → last 2026-08-08
Peak priority
notable
1 notable
Sources cited
1
1 hosts
Sections touched
1
active-threats
Co-occurring entities
0
no co-occurrence
ATT&CK techniques
5
pinned v19.1 · see below

Hunting pivots

ATT&CK techniques
T1102.002T1189T1204.002T1219T1583.006
Affected products
ConnectWise ScreenConnect
Tags
ai-abuseinfostealerphishing

ATT&CK techniques

5 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Resource Development TA0042

T1583.006Acquire Infrastructure: Web Services×1

Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.

Evidence: 2026-08-08/screenconnect-app-store-fake-update-distribution-campaign · ATT&CK page ↗

Initial Access TA0001

T1189Drive-by Compromise×1

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:

Evidence: 2026-08-08/screenconnect-app-store-fake-update-distribution-campaign · ATT&CK page ↗

Execution TA0002

T1204.002User Execution: Malicious File×1

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

Evidence: 2026-08-08/screenconnect-app-store-fake-update-distribution-campaign · ATT&CK page ↗

Command and Control TA0011

T1102.002Web Service: Bidirectional Communication×1

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.

Evidence: 2026-08-08/screenconnect-app-store-fake-update-distribution-campaign · ATT&CK page ↗

T1219Remote Access Tools×1

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Evidence: 2026-08-08/screenconnect-app-store-fake-update-distribution-campaign · ATT&CK page ↗

Story timeline

  1. 2026-08-08A ScreenConnect distribution campaign fronts fake Microsoft Store and App Store update dialogs, and binds each installer to its operator's relay with an embedded key
    active-threatsInteractive fake-update modals, cloud-hosted payloads and self-registering RMM installers deployed at guest permission to stay quiet

Where this entity is cited

  • active-threats1

Source distribution

  • levelblue.com1 (100%)

explore in graph

All cited sources (1)

Entries about ScreenConnect app-store-themed fake-update distribution campaign (1)

2026-08-08 · view entry permalink →

NOTABLENATOB2

A ScreenConnect distribution campaign fronts fake Microsoft Store and App Store update dialogs, and binds each installer to its operator's relay with an embedded key

LevelBlue's SpiderLabs OpsCTI team is tracking a ScreenConnect distribution campaign whose lure has moved past the static fake-update page. Instead, it "recreates convincing software update and installation alerts by impersonating the Microsoft Store and Apple App Store while reproducing the look and behavior of trusted applications through dynamic modal dialogs and other interactive web elements", also imitating the Google Meet pre-join screen, with progress bars and camera and microphone permission prompts that behave the way the real dialogs do (LevelBlue SpiderLabs, 2026-08-07).

The installation chain is a batch script into PowerShell into an MSI installed silently through msiexec.exe /quiet with UAC elevation. The operational detail worth carrying is what happens next: "Because each installer is cryptographically bound to its corresponding relay server through the embedded public key, it automatically registers with the attacker's ScreenConnect instance once installed" (LevelBlue SpiderLabs, 2026-08-07). The agent is deployed at guest-level permission rather than full administrative rights, which keeps its footprint small and its behaviour closer to a legitimate support install.

The delivery infrastructure is built to survive the loss of any single component: thousands of near-identical phishing-framework deployments, payloads hosted on legitimate cloud object storage (AWS S3, Cloudflare R2), anti-automation gating through honeypot form fields, artificial delays and User-Agent filtering to Windows desktop clients only, and full victim fingerprinting — address, geolocation, ISP, browser, timezone, screen resolution — before an installer is served at all. Successful infections notify the operator in real time through the Telegram Bot API. LevelBlue assesses the supporting scripts as AI-assisted on the basis of unusually verbose documentation-style inline comments and emoji markers (LevelBlue SpiderLabs, 2026-08-07).

Triage: the benign lookalike is a real support session, and it is common. The discriminators the cited mechanics support, in order of strength: the relay hostname the client registers to; installation at guest-level permission with no corresponding helpdesk ticket; and the process lineage — a browser spawning a batch script or PowerShell that calls msiexec.exe /quiet, which is not how a user or an administrator installs remote-support software deliberately. The fingerprinting gate also means an analyst re-visiting the lure URL from a sandbox or a non-Windows client will usually be served a decoy rather than the installer, so failure to reproduce the payload is not evidence the report is wrong.

impersonating the Microsoft Store and Apple App Store

Because each installer is cryptographically bound to its corresponding relay server through the embedded public key, it automatically registers with the attacker's ScreenConnect instance once installed.

LevelBlue SpiderLabs 2026-08-07
threat08 Aug 05:19Zsingle-sourceOpen finding ↗
Sources: LevelBlue SpiderLabs