--- title: What this "OBS Studio" is really doing? | daily.dev description: A fake OBS Studio website served via Bing Ads delivers malware that silently installs ScreenConnect (a remote management tool) alongside the real OBS installer... canonical: https://daily.dev/posts/what-this-obs-studio-is-really-doing--0shedziij twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What this "OBS Studio" is really doing? | daily.dev og:description: A fake OBS Studio website served via Bing Ads delivers malware that silently installs ScreenConnect (a remote management tool) alongside the real OBS installer... og:url: https://daily.dev/posts/what-this-obs-studio-is-really-doing--0shedziij og:image: https://api.daily.dev/og/posts/0SHEDzIij.png og:image:alt: What this "OBS Studio" is really doing? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What this "OBS Studio" is really doing? **[Eric Parker](https://daily.dev/sources/ericparker)** · 16 min read · 0 upvotes · 0 comments ## Summary A fake OBS Studio website served via Bing Ads delivers malware that silently installs ScreenConnect (a remote management tool) alongside the real OBS installer to avoid suspicion, while also establishing registry persistence. The Windows payload is stealthy enough that a casual user would likely not notice. The Mac version of the same malware is far less stealthy due to macOS Gatekeeper and permission prompts. A second Mac-targeting payload is also analyzed — a crypto scam that exfiltrates the user's keychain database. Key takeaway: Windows malware has equal-privilege access to all running programs, while macOS requires elevation tricks or exploits, offering some security advantage but not immunity. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [How a single ScreenConnect incident exposed a massive campaign](https://daily.dev/posts/how-a-single-screenconnect-incident-exposed-a-massive-campaign-hxzs54kdz) · Securelist · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/what-this-obs-studio-is-really-doing--0shedziij) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What this \"OBS Studio\" is really doing?","url":"https://daily.dev/posts/what-this-obs-studio-is-really-doing--0shedziij","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-this-obs-studio-is-really-doing--0shedziij"},"datePublished":"2026-04-14T16:04:10.344Z","dateModified":"2026-04-14T16:14:47.520Z","description":"A fake OBS Studio website served via Bing Ads delivers malware that silently installs ScreenConnect (a remote management tool) alongside the real OBS installer...","image":"https://i.ytimg.com/vi/fwJKKrg1OJM/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/fwJKKrg1OJM/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Eric Parker","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Eric Parker","logo":"https://media.daily.dev/image/upload/s--vVcOpkjx--/f_auto/v1724391603/logos/ericparker","url":"https://daily.dev/sources/ericparker"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-this-obs-studio-is-really-doing--0shedziij","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,malware","timeRequired":"PT16M","video":{"@type":"VideoObject","name":"What this \"OBS Studio\" is really doing?","description":"A fake OBS Studio website served via Bing Ads delivers malware that silently installs ScreenConnect (a remote management tool) alongside the real OBS installer...","thumbnailUrl":"https://i.ytimg.com/vi/fwJKKrg1OJM/sddefault.jpg","uploadDate":"2026-04-14T16:04:10.344Z","duration":"PT16M","url":"https://api.daily.dev/r/0SHEDzIij","embedUrl":"https://www.youtube.com/embed/fwJKKrg1OJM"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Eric Parker","item":"https://daily.dev/sources/ericparker"},{"@type":"ListItem","position":3,"name":"What this \"OBS Studio\" is really doing?"}]} ```