Two distinct campaigns were identified. Campaign 1 (SMOKE#SCREEN): An active multi-wave campaign using social engineering lures themed around Adobe and Zoom software updates, business document reviews, and system maintenance utilities to deploy ConnectWise ScreenConnect RMM tool. The toolkit includes VBScript droppers, batch file loaders, compiled .NET executables, and an HTML phishing page, all pointing to a WsgiDAV-based staging server at 207.174.0[.]143:8080. Initial access is via spear-phishing emails delivering obfuscated VBScript droppers that perform environment and anti-analysis checks (checking for Wireshark, Process Monitor, VirtualBox, VMware Tools, XenServer, Fiddler). If checks pass, a PowerShell command fetches a C# payload from 207.189.11[.]170. A third delivery variant uses a compressed archive containing a batch script that disables AMSI, escalates privileges via UAC prompt, disables SmartScreen via Registry modifications, removes Zone.Identifier ADS from the MSI file, and installs ScreenConnect. Payloads were hosted on Dropbox and delivered via Cloudflare Quick Tunnels (subscription-magnetic-recommended-meat.trycloudflare.com). Three distinct C2 clusters were identified based on ScreenConnect relay configuration strings. ScreenConnect beacons to attacker-controlled relay servers on port 8041. Campaign 2 (Powercat/Fake Xeno Roblox): Fake Xeno Executor installers distributed via gaming forums and Discord initiate a multi-stage Java infection chain. A 'xeno.exe' runs the first stage, checks for Java Runtime Environment, reads 'XenoIcon.jpg' for C2 validation keys, contacts C2 at solthere[.]net, then launches an obfuscated JAR file disguised as 'decompiler.exe'. The final payload (Powercat) is a Java-based stealer and surveillance malware capable of credential theft, browser cookie theft, Discord/Roblox/Minecraft account theft, cryptocurrency wallet theft, keylogging, webcam access, desktop streaming, file manipulation, PowerShell command execution, and interactive shell access. It targets Exodus wallet version 26.1.5 specifically by unpacking app.asar and injecting JavaScript to capture tokens.