Fake Adobe Acrobat Pages Distribute Signed ScreenConnect Remote‑Access Tool to Compromise Windows PCs
What Happened — Researchers at CloudSEK observed a new phishing campaign that hosts counterfeit Adobe Acrobat web pages. When a victim clicks the “Open” button, the page silently triggers a download of a legitimately signed ScreenConnect (ConnectWise Control) installer. The installer is pre‑configured to connect back to attacker‑controlled servers, granting the threat actors remote desktop access to the victim’s Windows machine. The malicious payload is delivered via a short URL, evading many URL‑filtering solutions, and the signed binary bypasses basic anti‑malware checks. The campaign has been active since early October 2024 and targets users across multiple industries, primarily through mass‑mail phishing and malicious advertising.
Why It Matters for Trust & Control Assurance — The attack underscores the importance of continuous security‑awareness training and strict verification of software signatures to satisfy access‑control and incident‑response controls.
Who Is Affected — Enterprises with Windows endpoints across technology, finance, healthcare, and other sectors.
Recommended Actions
- Refresh phishing‑simulation programs to include fake‑document scenarios and test user response to unexpected installer prompts.
- Enforce application‑control policies (e.g., whitelist approved binaries, require multi‑factor approval for remote‑access tools).
- Monitor for anomalous remote‑access connections and maintain audit logs of installer executions.
Source: HackRead
Technical Notes
- Attack vector: Phishing via counterfeit Adobe Acrobat web pages.
- Payload: Signed ScreenConnect (ConnectWise Control) installer configured for attacker‑controlled remote access.
- Detection challenges: Signed binary evades many AV solutions; short URLs obscure final destination.
Source: HackRead