Fake Zoom update malware campaign expands its reach to macOS

A malware campaign is using fake Zoom updates and business files to install ScreenConnect, giving attackers remote control through software that can resemble legitimate IT activity. Fake Zoom update Securonix researchers detailed the campaign, named Smoke#Screen, in an August 4 report. They traced Windows scripts, compiled loaders, an HTML phishing page and a macOS package named "ZoomUpdateInstaller.pkg" to shared infrastructure.