macOS ZoomUpdateInstaller.pkg Execution Correlated with Connection to SMOKE#SCREEN Relay 207.174.0.143:8080

Duo Tech@duotech

•updated Aug 5, 2026•1•0•5

Detects execution/creation of the fake Zoom update installer (ZoomUpdateInstaller.pkg) on macOS endpoints correlated with a network connection to the SMOKE#SCREEN campaign relay IP 207.174.0.143 on port 8080.