SMOKE#SCREEN uses fake Adobe and Zoom updates, document lures, and trusted cloud services to install ScreenConnect for persistent remote access.

Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals ...