Cybercriminals used fake Adobe Acrobat document-signing pages to trick Windows users into downloading legitimate ConnectWise ScreenConnect remote-access installers. The installers were digitally signed but preconfigured to connect to unauthorized remote-access tenants, potentially giving an outside operator persistent control of the device. No victim compromises were confirmed, but the campaign provides a realistic document-signing lure that organizations can train against.
The campaign relied on fake Adobe Acrobat Reader-themed document-signing pages that told visitors they needed to install remote-control software before a document could be signed or viewed. Visitors who followed the call to action downloaded genuine, digitally signed ConnectWise ScreenConnect installers. These installers were not modified malware, but they were preconfigured to connect to two unauthorized ScreenConnect Cloud tenants, identified as omydze and vvvzou. The analyzed clients included a service that starts automatically as LocalSystem, creating a high-confidence risk of persistent remote access for an external operator if the software was installed and run.
Before delivering the client, the fake pages also collected visitor information, including IP address, device and browser details, location, timestamps, and ISP data, through Telegram bots. No victim compromises or credential capture were confirmed in connection with this activity.
This lure worked because it exploited a routine business process, document signing, that employees in finance, legal, human resources, and procurement roles encounter regularly. Framing the installation step as a required part of that workflow lowered suspicion. The use of a genuine, digitally signed installer compounded the problem: conventional defenses that check file signatures or block a single installer hash are insufficient here, since legitimate remote-access clients can be built for different unauthorized tenants without changing the underlying signed software.
Organizations and employees can reduce this risk with a few concrete steps:
These steps map to recognized techniques including T1566.002, T1204.002, T1219, and T1543.003, and they reinforce that user verification combined with tenant-level monitoring is more effective than signature checks alone.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers used Adobe Acrobat Reader-themed pages to present a document-signing request that required installing a remote-access client before the document could be viewed or signed.
No, the installers were genuine, digitally signed ConnectWise ScreenConnect clients. The risk came from their configuration to connect to unauthorized ScreenConnect Cloud tenants rather than from trojanized code.
Because the software is legitimate and signed, file signature or hash checks alone will not reveal that it is configured to connect to an unapproved remote-access tenant.
They should independently verify the request before installing anything and report unexpected remote-control software prompts to IT or security rather than proceeding.
An Adobe document to sign? Why does it need remote access? A fake page at clickksy dot icu says, 'Install the required client to continue.' The download is a real, digitally signed ConnectWise ScreenConnect installer. Here’s the catch: signed doesn’t mean approved. That installer points to unauthorized tenants, omydze or vvvzou, and could start automatically with powerful system access. If signing a document requires a remote-access install, stop and report the prompt to IT.
Microsoft observed real Q3 2026 phishing campaigns that used familiar workplace requests to steal credentials or deliver malware. One campaign targeted legal organizations with personalized salary-review documents containing QR codes, while another used purchase-order and payroll lures in disguised…
The article describes active campaigns that use familiar business documents, trusted file-sharing services, AI brands, and Microsoft sign-in flows to trick employees into granting account access. The most actionable patterns are phishing emails and document links that lead victims to Microsoft…
Akamai documented scam operations that use large numbers of look-alike shopping and ticketing websites to steal payment and identity information. The operators can quickly replace a removed site with another domain connected to the same payment-data collection system. Other campaigns used…
Check Point researchers identified a large credential-phishing campaign that used counterfeit calendar invitations to send people to fake Microsoft sign-in pages. The campaign used calendar attachments and deceptive meeting links, and targeted more than 40,000 organizations with over 302,000…
Threat actors are hijacking existing email conversations, or patiently starting new ones, to build trust before sending a malicious reply. The final message commonly poses as a meeting invitation, secure message, shared file, or important document and leads to credential theft or remote-access…
Attackers created fake GitHub repositories that copied the names of PS5 emulator projects, luring gamers searching for ways to play PS5 games on a PC. The ZIP downloads did not contain working emulators; they launched malware that evaded analysis, attempted to weaken Microsoft Defender protections,…
