Cybercriminals are using fake Adobe Acrobat and document-signing pages to distribute legitimate ConnectWise ScreenConnect remote-access software, potentially giving external operators persistent access to Windows systems.
A new CloudSEK investigation reveals how trusted, digitally signed software is being used with unauthorized remote-access configurations, creating risks that conventional file-signature checks alone may not detect.
Key findings:
- Legitimate software abused: Two genuine, digitally signed ScreenConnect installers were identified with configurations pointing to separate remote-access tenants. The installers were not found to be trojanized.
- Suspicious infrastructure: Researchers analysed eight additional URLs linked to document-signing lures. Five page variants shared nearly identical JavaScript and a common background image.
- Telegram-based tracking: The pages sent visitors’ IP addresses, ISP details, device and browser information, timestamps and location data to Telegram bots.
- Selective downloads: The pages checked visitors’ operating systems and ISPs before automatically delivering ScreenConnect clients.
- Potential persistent access: Static analysis showed that the Adobe-associated installers were configured to create automatically starting Windows services running as LocalSystem.
- Five ScreenConnect tenants identified: Researchers documented the tenant identifiers and associated infrastructure to help security teams investigate unauthorized installations.
The investigation did not confirm any victim compromise or establish the identity of the operators.
The report includes technical findings, indicators of compromise (IOCs), ScreenConnect tenant identifiers and recommended defensive actions.
Full research: https://www.cloudsek.com/blog/fake-adobe-acrobat-lures-deliver-screenconnect-remote-access-clients
Related
This entry was posted on October 30, 2026 at 10:57 am and is filed under Commentary with tags CloudSEK. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Fake Adobe Acrobat Pages Used to Deliver Remote Access Software
Cybercriminals are using fake Adobe Acrobat and document-signing pages to distribute legitimate ConnectWise ScreenConnect remote-access software, potentially giving external operators persistent access to Windows systems.
A new CloudSEK investigation reveals how trusted, digitally signed software is being used with unauthorized remote-access configurations, creating risks that conventional file-signature checks alone may not detect.
Key findings:
The investigation did not confirm any victim compromise or establish the identity of the operators.
The report includes technical findings, indicators of compromise (IOCs), ScreenConnect tenant identifiers and recommended defensive actions.
Full research: https://www.cloudsek.com/blog/fake-adobe-acrobat-lures-deliver-screenconnect-remote-access-clients
Share this:
Like this:
Related
This entry was posted on October 30, 2026 at 10:57 am and is filed under Commentary with tags CloudSEK. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.