← Back to Feed

Beyond ‘Fake Updates’: From Application Store-Themed Phishing to Large-Scale Distribution of ScreenConnect

August 7, 2026 · LevelBlue SpiderLabs · Severity: MEDIUM

LevelBlue OpsCTI identified a large-scale phishing campaign that uses application store-themed fake updates to deploy unauthorized ConnectWise ScreenConnect clients. The campaign recreates convincing update and installation alerts by impersonating the Microsoft Store and Apple App Store while mimicking trusted applications such as Google Meet and Zoom.

Key Takeaways

  • Phishing campaign impersonates Microsoft Store and Apple App Store to deploy ScreenConnect.
  • Attackers recreate update alerts and installation dialogs using dynamic interactive web elements.
  • The campaign targets users by mimicking popular apps like Google Meet and Zoom.
☕ Buy a Coffee