Fake App Stores and Software Updates Deliver Unauthorized ScreenConnect Clients
Summary
LevelBlue researchers traced a phishing campaign using fake app stores, meeting pages and document portals to distribute unauthorized ScreenConnect clients. Shared web resources and DNS artifacts linked related infrastructure.
Key points
- LevelBlue observed increased activity in July 2026 involving phishing pages impersonating Google Meet, Microsoft Store, Apple App Store and document-sharing services.
- A reconstructed Google Meet lure simulates a meeting and software update before downloading a ScreenConnect installer through a hidden iframe; execution still requires victim interaction.
- Preconfigured clients register with attacker-controlled ScreenConnect instances using embedded relay settings and public keys, enabling unauthorized remote access after installation.
- Some variants deliver batch files that request UAC elevation, decode an Amazon S3 download URL and silently install an MSI through msiexec.
- Payloads are distributed through compromised websites, attacker-controlled hosts, Amazon S3 and Cloudflare R2; some pages use Windows validation and anti-automation checks.
- Profiling scripts collect browser, device and location information and send visit or download notifications through hard-coded Telegram bots.
- Researchers correlated deployments using repeated HTTP resource hashes, directory layouts and reverse DNS artifacts, and recommend investigating unapproved ScreenConnect clients and relay connections.
Article Details
- Attack Vectors
- Brand-impersonating meeting, application-store, document, and invitation pages induce victims to install unauthorized remote access clients through fake update and download workflows.
- Compromised websites and apparently operator-controlled hosts distribute installers directly or stage downloads through Amazon S3 and Cloudflare R2.
- Hidden iframes trigger installer or batch-file downloads; batch files request UAC elevation, decode payload URLs, download MSI packages with PowerShell, and install them silently.
- Browser and server-side profiling route visitors to platform-specific pages, while some variants use hidden honeypot fields and minimum interaction times to restrict automated access.
- Hard-coded Telegram bots receive victim environment information and notifications of page visits and download attempts.
- Defensive Notes
- Inventory ScreenConnect installations and investigate clients communicating with unknown or unapproved relay instances, including trial instances.
- Monitor executable and MSI downloads from unfamiliar hosts and public object storage following meeting, document-sharing, or software-update lures.
- Hunt for reused HTTP resource hashes, directory structures, and reverse DNS artifacts identified in the research.
- Detect or block application impersonation pages and lookalike domains.
- Inspect Telegram Bot API traffic where there is no legitimate business requirement.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | aspenbio[.]top | Campaign phishing host associated with Microsoft Teams transcript lures. |
| DOMAIN | bestchoice[.]sa[.]com | Phishing framework host that researchers assessed appeared directly controlled by the operator. |
| DOMAIN | cloudyspoon[.]store | Campaign phishing host listed under PUNCHBOWL electronic card invitation lures. |
| DOMAIN | ecoprune[.]site | Campaign phishing host associated with U.S. Social Security Administration impersonation. |
| DOMAIN | islund[.]site | Campaign phishing host listed under Adobe Acrobat and Blue Mountain lures. |
| DOMAIN | jumpingcloud[.]top | Reused campaign lure host associated with government-document impersonation. |
| DOMAIN | paperorbit[.]cloud | Campaign lure host listed among ScreenConnect distribution indicators. |
| DOMAIN | paperwhale[.]cloud | ScreenConnect campaign host identified in the final IOC table. |
| DOMAIN | pixelio[.]site | Reused campaign lure host associated with government-document impersonation. |
| DOMAIN | seoulapp[.]tech | Campaign phishing host associated with Microsoft Teams transcript lures. |
| IPV4 | 69[.]49[.]246[.]105 | Infrastructure hosting the phishing framework, described as attacker-controlled in the infrastructure analysis. |
| SHA256 | 415da0881ae2019a096bba596c1643fee0ec44d08682f748f88a39665d99a375 | Campaign batch payload hash associated with InviteJuly26.bat and Q12 2026 SETTLEMENT.bat. |
| SHA256 | 424ebbbec7a6498badfe12e973247252ee4f5f789c3f2007e716ec745a3cc55b | Campaign batch payload hash associated with Q10-2026SETTLEMENT.bat. |
| SHA256 | 5b6cff6946771502aab7f60038ff20b7e45d19ef5c5ed95b4ff0b8193ca4b75a | Campaign batch payload hash associated with 2026Q1SETTLEMENT.bat. |
| SHA256 | 7ad5b98d8790fe81408708df0ff2c607eea50021e9864942d66a297ea90c2c31 | ScreenConnect payload hash listed under the fake Google Meet update lure. |
| SHA256 | 7f8907a05b737e1b4ddedfe870cb99c0352a2cd8373671c26854d9711b88849b | Reused static phishing framework resource hash observed across approximately 70 hosts. |
| SHA256 | 7fd3d2956d216c23e560f747d2ea30fb469986fac634ddc483e38bcca49bdd95 | Hash of the reused phishing redirector response that routes Windows visitors to campaign landing pages. |
| SHA256 | 9cc0dfa491f5eebdca6a351e699886946b0b96fdbcb7d454ea15af2fffdf6b93 | Static campaign HTTP resource hash observed across approximately 1,700 hosts and used for infrastructure hunting. |
| SHA256 | bc9bcb5915fdc314ed0b3de952c83b3380048c4ffd1bc3579b7e1badd7fa9181 | Malicious batch payload hash associated with INVOICE2515.bat and ViewDoc271.bat. |
| SHA256 | c71ddfa376b2a86bae93d46d997742502d127979a8774402c936ec6832bb91d0 | Malicious batch payload hash associated with QUOTE 36C.bat and Q4 2026 SETTLEMENT.bat. |
| SHA256 | d30d6a29859de6ff8232e346a044322cc53a02bca1d78bdaa8edde74def982db | Reused static phishing framework resource hash observed across approximately 120 hosts. |
| URL | hxxps[:]//bieagtdk[.]s3[.]us-east-2[.]amazonaws[.]com/ScreenConnect.ClientSetup.msi | Amazon S3 installer distribution resource listed in the campaign IOC table. |
| URL | hxxps[:]//eobtdk[.]s3[.]us-east-2[.]amazonaws[.]com/ScreenConnect.ClientSetup.msi | Amazon S3 URL used to deliver an unauthorized ScreenConnect installer. |
| URL | hxxps[:]//ieabgtsk[.]s3[.]us-east-1[.]amazonaws[.]com/ScreenConnect.ClientSetup.msi | Amazon S3 installer distribution resource listed in the campaign IOC table. |
| URL | hxxps[:]//kilodz[.]s3[.]us-east-2[.]amazonaws[.]com/ScreenConnect.ClientSetup.msi | Amazon S3 URL used to deliver an unauthorized ScreenConnect installer. |
| URL | hxxps[:]//pub-39190877e0004c3a84a95c22db10d23b[.]r2[.]dev/Secure_Document_Viewer.msi | Cloudflare R2 payload URL serving an MSI disguised as a secure document viewer. |
| URL | hxxps[:]//pub-b42d42acf73b4e5887636c7e58ea9500[.]r2[.]dev/msi/6707110503/20260708_184219_e1bdbdc9.msi | Specific Cloudflare R2 MSI distribution resource listed in the campaign IOC table. |
| URL | hxxps[:]//pub-b42d42acf73b4e5887636c7e58ea9500[.]r2[.]dev/msi/8405320297/20260630_154034_69eb5426.msi | Specific Cloudflare R2 MSI distribution resource listed in the campaign IOC table. |
| URL | hxxps[:]//pub-d7ab35315be7454889d8f97c69fc2074[.]r2[.]dev/SSA_STATEMENT_EN_US.zip | Cloudflare R2 payload URL delivering an archive containing a ScreenConnect installer after fraudulent identity verification. |
| URL | hxxps[:]//stcdubai[.]com/googlemeet/ | Fake Google Meet landing page leading to unauthorized ScreenConnect installation. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationBatch scripts conceal the S3 payload URL as a sequence of three-digit ASCII values decoded by PowerShell.T1036.005 · Match Legitimate Resource Name or LocationScreenConnect installers are presented under lure-consistent names such as Invitation_RSVP.exe and Secure_Document_Viewer.msi.T1059.001 · PowerShellBatch payloads invoke PowerShell to request elevation, decode an ASCII-encoded URL, and download an MSI with Invoke-WebRequest.T1059.003 · Windows Command ShellWindows batch scripts launch commands, run the MSI installer, and delete the temporary package.T1070.004 · File DeletionThe installation batch file deletes the temporary MSI after msiexec completes.T1082 · System Information DiscoveryProfiling scripts collect operating system, device type, screen resolution, time zone, and browser environment information.T1105 · Ingress Tool TransferPowerShell retrieves ScreenConnect MSI payloads from remote object storage before installation.T1204.002 · Malicious FileVictims are persuaded to execute downloaded ScreenConnect installers or themed batch files.T1218.007 · MsiexecBatch payloads run msiexec with /quiet /qn /norestart to install downloaded ScreenConnect MSI packages.T1219.002 · Remote Desktop SoftwareInstalled ScreenConnect clients automatically register with attacker-controlled instances to provide remote access.T1564.003 · Hidden WindowPowerShell and the elevated command process run with WindowStyle Hidden to reduce visibility during installation.T1566 · PhishingPhishing pages impersonate meeting services, application stores, document portals, and electronic invitations to deliver unauthorized ScreenConnect clients.
Malware
Vendors
AmazonThe campaign uses compromised sites, attacker-controlled hosts, Amazon S3, Cloudflare R2, Telegram telemetry, and reused infrastructure artifacts to deliver remote access payloads and expand hunting opportunities.CloudflareThe campaign uses compromised sites, attacker-controlled hosts, Amazon S3, Cloudflare R2, Telegram telemetry, and reused infrastructure artifacts to deliver remote access payloads and expand hunting opportunities.ConnectWisecampaign that impersonates trusted apps and services to trick victims into installing unauthorized ConnectWise ScreenConnect clients through fake update and installation flows.
Products
Amazon S3The campaign uses compromised sites, attacker-controlled hosts, Amazon S3, Cloudflare R2, Telegram telemetry, and reused infrastructure artifacts to deliver remote access payloads and expand hunting opportunities.Cloudflare R2The campaign uses compromised sites, attacker-controlled hosts, Amazon S3, Cloudflare R2, Telegram telemetry, and reused infrastructure artifacts to deliver remote access payloads and expand hunting opportunities.ConnectWise ScreenConnectthat impersonates trusted apps and services to trick victims into installing unauthorized ConnectWise ScreenConnect clients through fake update and installation flows.