Cybercriminals using fake software updates to take over computers: Report

Fake alerts about Adobe and Zoom trick users into installing remote access software that gives attackers control of infected devices

Cybercriminals are using fake Adobe and Zoom update prompts to trick users into handing over control of their computers, according to a new report by Securonix Threat Research.

 

Rather than exploiting software flaws, the campaign relies on social engineering — manipulating users into installing remote access malware disguised as routine updates

 

Securonix found that the campaign uses multiple social engineering themes, including fake Zoom updates, Adobe update prompts, business document reviews and system maintenance utilities to lure people into downloading malicious files. Although the tricks differ, every attack has the same objective: silently install a legitimate ScreenConnect Remote Monitoring and Management client that connects the compromised computer to attacker-controlled servers and provides persistent remote access.

 

 

Multiple tricks, one objective

 

The attackers rotate between different themes to reach different groups of users. Someone working in an office may receive a business document review file, while another user could encounter a fake Zoom update or Adobe installer. System maintenance tools are also used as disguises.

 

Researchers uncovered the campaign after analysing a malicious VBScript file named “zoom-update.vbs”, which led them to a live staging server hosting multiple payloads.

 

By dissecting the infrastructure, the team reconstructed five distinct attack chains, identified three ScreenConnect relay servers, and mapped how the attackers evolved their tactics over time.

 

All observed attack paths ultimately installed a ScreenConnect client that connected victims to an attacker-controlled server. Because ScreenConnect is a legitimate IT management tool, its presence easily blends into normal network activity without raising suspicion.

 

Fake software updates

 

A core tactic in this campaign is impersonating legitimate software updates. The attackers deployed a phishing page, zoom-update.html, that mirrors Zoom's official interface — complete with logos, brand colors, and fake version numbers.

 

To pressure victims into acting, the page warns that their Zoom client is outdated and insecure, claiming a critical update is required before they can join meetings.

 

To maximise success, the site automatically triggers the download after two seconds using JavaScript. A fake progress bar appears while victims are prompted to run ZoomUpdateInstaller.msi. Instead of a real update, users receive a malware installer—hosted directly on Dropbox to slip past security filters unnoticed.

 

Researchers also found another phishing page impersonating an Adobe Flash Player update. Compared with the Zoom page, this version uses a simpler design, which Securonix believes was created for faster deployment across multiple campaigns.

 

Trusted software becomes the bait

 

The report noted that the attackers use famous software names to convince users that the files are genuine. One file was named ‘AdobeReader_Update.exe’, while another file was disguised as ‘SystemCheck ’, giving the impression that it was a legitimate maintenance utility.

 

In one example, the SystemCheck file first asks for administrative privileges. Because it appears to be a routine maintenance tool, users may approve the request without suspecting that the file is malicious. Once permission is granted, the malware begins disabling security protections before downloading the final payload.

 

The report mentioned that the campaign reflects a broader trend in which threat actors increasingly depend on trusted brands and convincing social engineering rather than software exploits to gain initial access to victim systems.

 

How the malware avoids detection

 

The campaign evolved constantly to evade detection. Early iterations used obfuscated VBScript droppers equipped with sandbox detection, checking for virtual machines or security analysis environments. If low memory or analysis tools were detected, the malware immediately terminated.

 

Later versions took a more aggressive approach. A batch file disguised as "SystemCheck" bypassed Microsoft's Antimalware Scan Interface, escalated to administrator privileges, modified Windows SmartScreen, and added Defender exclusions before silently installing the payload. To minimize forensic evidence, it stripped file download security warnings and deleted the original installer.

 

Researchers also found a compiled .NET loader named ‘MemoryLoader.cs’ that executed an extensive Defender neutralisation sequence before downloading the payload through a Cloudflare Quick Tunnel. The loader added the entire ‘C:\’ drive as a Defender exclusion, disabled the Windows Defender service and deleted the installer after execution while keeping the loader process active to maintain persistence.

 

Securonix observed another change in the attackers' approach. Instead of aggressively disabling security software, newer versions of the loader focused on avoiding detection. The updated code introduced a three-minute delay before starting the installed service, a technique intended to break endpoint detection and response event correlation. According to the report, this indicates that the attackers were actively adapting their techniques based on defender responses.

 

Legitimate software used for malicious access

 

In every attack, the final malware installed on the victim's computer was ConnectWise ScreenConnect, a genuine remote access tool used by IT teams to fix computers from a distance. According to Securonix, the installer files were legitimate and digitally signed by ConnectWise using a trusted DigiCert certificate. Because the software is genuine and widely used, some security tools may not treat it as suspicious.

 

After the software was installed, it quietly connected the victim's computer to servers controlled by the attackers. This allowed the attackers to remotely access and control the infected device without the user's knowledge. Researchers found three different relay servers used in the campaign, helping the attackers keep the operation running even if one server was blocked.

 

The campaign did not target only Windows computers. Securonix also found a fake macOS installer called ZoomUpdateInstaller.pkg, showing that the attackers were also trying to infect Apple devices using the same technique.

 

Recommendations for organisations

 

Securonix recommends restricting the execution of untrusted MSI installers by using application control technologies such as AppLocker or Windows Defender Application Control. Organisations should also monitor attempts to disable Microsoft Defender, modify Defender policies or add large exclusion paths, as these actions may indicate malicious activity.

 

The report recommends maintaining a clear inventory of approved remote management tools and blocking unauthorised software like ScreenConnect. Organisations should monitor connections to raw IP addresses rather than legitimate vendor domains.

 

Additionally, defenders are advised to enforce strict User Account Control settings and deploy behavioural endpoint detection rules to spot suspicious process activity — such as PowerShell or Command Prompt silently executing MSI installers.