Weaponized JPEG Payload Deploys Trojanized ScreenConnect for Covert Espionage

CYFIRMA discovered a sophisticated intrusion campaign delivering a weaponized PowerShell loader disguised as sysupdate.jpeg that bypasses AMSI, dynamically compiles a unique launcher (uds.exe) with csc.exe, performs a fileless UAC escalation, and installs a trojanized ConnectWise ScreenConnect (named OneDriveServers) that provides persistent remote access, credential harvesting, hidden desktop capabilities, and strong session-specific encryption.