SMOKE#SCREEN and Powercat Campaigns Abuse RMM and Java

Security researchers have identified two prominent concurrent campaigns, SMOKE#SCREEN and Powercat, targeting diverse environments through social engineering. The SMOKE#SCREEN campaign utilizes fake Adobe and Zoom update lures to deploy legitimate ConnectWise ScreenConnect RMM agents, providing attackers with persistent, authorized-looking remote access. Concurrently, the Powercat campaign targets the gaming community via fake Roblox and Minecraft cheats to deliver a sophisticated Java-based information stealer capable of surveillance and financial theft.

Technical analysis reveals a rapid evolution in adversary tradecraft, moving from aggressive security-tool destruction sequences (disabling Windows Defender and AMSI) to stealthier anti-EDR tactics, such as introducing 3-minute sleep delays to break event correlation. The use of trusted infrastructure, including Dropbox for hosting and Cloudflare Quick Tunnels for staging, allows these actors to bypass standard domain reputation filters.

These campaigns represent a significant risk to both corporate and personal environments. By abusing legitimate RMM tools and targeting high-value gaming and cryptocurrency accounts, the attackers can maintain long-term persistence, conduct real-time surveillance, and facilitate direct financial loss through wallet injection and credential exfiltration.