Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook

Dark Reading reports that threat actors are conducting active RMM-fueled phishing campaigns as of August 2026. The attacks use diverse social engineering lures and rotating payloads to deliver ScreenConnect for persistent remote access to compromised networks. The campaign targets global victims via email and web-based lures. The exact victim count, specific social engineering lures used, and detailed payload rotation schedule are unverified, but the campaign is confirmed to be active. ScreenConnect has been identified as the primary tool for maintaining unauthorized remote access, enabling potential data exfiltration, lateral movement, and ransomware deployment. The report notes that specific threat actor attribution has not been confirmed. Organizations are advised to apply latest ScreenConnect patches, enforce email security gateways, conduct user awareness training focused on RMM and remote access phishing, and monitor for unauthorized ScreenConnect installations.