A ScreenConnect distribution campaign fronts fake Microsoft Store and App Store update dialogs, and binds each installer to its operator's relay with an embedded key
LevelBlue's SpiderLabs OpsCTI team is tracking a ScreenConnect distribution campaign whose lure has moved past the static fake-update page. Instead, it "recreates convincing software update and installation alerts by impersonating the Microsoft Store and Apple App Store while reproducing the look and behavior of trusted applications through dynamic modal dialogs and other interactive web elements", also imitating the Google Meet pre-join screen, with progress bars and camera and microphone permission prompts that behave the way the real dialogs do (LevelBlue SpiderLabs, 2026-08-07).
The installation chain is a batch script into PowerShell into an MSI installed silently through msiexec.exe /quiet with UAC elevation. The operational detail worth carrying is what happens next: "Because each installer is cryptographically bound to its corresponding relay server through the embedded public key, it automatically registers with the attacker's ScreenConnect instance once installed" (LevelBlue SpiderLabs, 2026-08-07). The agent is deployed at guest-level permission rather than full administrative rights, which keeps its footprint small and its behaviour closer to a legitimate support install.
The delivery infrastructure is built to survive the loss of any single component: thousands of near-identical phishing-framework deployments, payloads hosted on legitimate cloud object storage (AWS S3, Cloudflare R2), anti-automation gating through honeypot form fields, artificial delays and User-Agent filtering to Windows desktop clients only, and full victim fingerprinting — address, geolocation, ISP, browser, timezone, screen resolution — before an installer is served at all. Successful infections notify the operator in real time through the Telegram Bot API. LevelBlue assesses the supporting scripts as AI-assisted on the basis of unusually verbose documentation-style inline comments and emoji markers (LevelBlue SpiderLabs, 2026-08-07).
Triage: the benign lookalike is a real support session, and it is common. The discriminators the cited mechanics support, in order of strength: the relay hostname the client registers to; installation at guest-level permission with no corresponding helpdesk ticket; and the process lineage — a browser spawning a batch script or PowerShell that calls msiexec.exe /quiet, which is not how a user or an administrator installs remote-support software deliberately. The fingerprinting gate also means an analyst re-visiting the lure URL from a sandbox or a non-Windows client will usually be served a decoy rather than the installer, so failure to reproduce the payload is not evidence the report is wrong.
impersonating the Microsoft Store and Apple App Store
Because each installer is cryptographically bound to its corresponding relay server through the embedded public key, it automatically registers with the attacker's ScreenConnect instance once installed.
Defender actions
- Alert on ScreenConnect client installation where the relay hostname is not one your organisation operates — the campaign's installers self-register to an attacker relay on install, so the relay identity is the discriminator that survives every cosmetic change to the lure.
ATT&CK mapping
5 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Resource Development TA0042
T1583.006Acquire Infrastructure: Web Services
Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.
Initial Access TA0001
T1189Drive-by Compromise
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:
Execution TA0002
T1204.002User Execution: Malicious File
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.
Command and Control TA0011
T1102.002Web Service: Bidirectional Communication
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.
T1219Remote Access Tools
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.