Researchers observed real phishing emails posing as transaction receipts to trick people into opening a PDF attachment. The PDF claims an “Adobe Flash Player update is required,” leading victims to download and run a script that silently installs ScreenConnect for persistent remote access.
This campaign began with phishing emails disguised as transaction receipts, impersonating employees of a US company. The message body asked recipients to review an attached PDF and confirm whether funds had been deposited into their account, a pretext designed to prompt quick, unquestioning action from finance and accounts payable staff.
Opening the attached PDF, named to resemble a transaction confirmation file, displayed what appeared to be an international money transfer document. The PDF then showed a fake prompt claiming an Adobe Flash Player update was required to view the content, encouraging the victim to click a download link. That click used Adobe Reader's external link feature to redirect the victim to attacker-controlled infrastructure hosted on Vercel, where a VBS file disguised as a Flash updater was downloaded.
The attack relied on a familiar business scenario, confirming a payment or deposit, which creates urgency and plausibility without requiring sophisticated technical deception. Layering a second social engineering step inside the PDF itself, the fake software update prompt, added a further barrier that most users are not trained to scrutinize. Running the downloaded script quietly installed a malicious MSI package in the background while displaying a decoy payment receipt PDF, reinforcing the illusion that nothing unusual had happened.
Organizations should train finance and accounts payable staff, along with all employees, to treat unsolicited payment or receipt emails as suspicious and to verify them through a known, trusted contact method rather than the email itself. Employees should be reminded that legitimate document viewers never require in-document software updates, and that Flash Player specifically is obsolete and no longer updated. IT and helpdesk teams benefit from reinforcing that any unexpected download or installation prompt, especially one involving remote access or management software, should be reported immediately so it can be investigated before persistent access is established.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Victims receive an email claiming a transaction receipt is attached and are asked to confirm whether funds were deposited. Opening the PDF triggers a fake prompt claiming an Adobe Flash Player update is required, which leads to downloading and running a VBS script that installs a remote access tool.
Flash Player is obsolete and no longer requires updates, so any document asking you to install one is a strong indicator of a scam. In this case, clicking the prompt redirected victims to attacker-controlled infrastructure hosting a malicious script.
The malicious installer deployed ScreenConnect, a legitimate remote management solution from ConnectWise, which the attacker used to establish persistent remote access to the infected system.
Finance and accounts payable staff, executives who approve payments, and any employee who handles invoices or payment confirmations are primary targets, though all employees are at risk.
You get an email: “Transaction receipt attached, please confirm funds were deposited.” Looks routine, right? You open the PDF. It shows an international transfer receipt, but then a big message pops up: “An updater to Adobe Flash Player is needed to view this PDF.” With a download button. Clicking it sends you to a Vercel site that downloads “adobe-flash-updater.Vbs”. When you run it, a fake payment_receipt.Pdf opens, but in the background ScreenConnect quietly installs and phones home to relay.Gamedbd.com:8041. Here’s the move: if a receipt PDF ever tells you to install or update Flash or any viewer, stop and forward that email to IT security immediately, don’t click anything inside it.
Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT…
Proofpoint linked multiple real-world email campaigns to “Cruciferra,” a commercial crypter service that helps criminals hide malware from security tools. The campaigns used familiar social-engineering themes, tax documents, U.S. Social Security Administration messages, and even bed-bug complaints,…
Researchers reported an active PhantomEnigma campaign where attackers hijacked 20+ Brazilian government websites and used them as trusted stepping-stones to deliver malware. The lure used official-looking police-themed documents (sometimes with QR codes) and emails that could pass common email…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
Check Point says North Korea’s Lazarus Group targeted defense and aerospace professionals using convincing fake job offers that led victims to download trojanized PDF software. The campaign used a Windows zero-day (now patched as CVE-2026-68820) to gain full control and hide from security tools,…
South Korean agencies warned that a state-backed hacking group is actively targeting citizens and businesses using job-themed phishing emails and “watering hole” attacks on legitimate websites. The phishing lures include fake job applicants sending resume links and impersonated recruiters sending…
