Fake Adobe Document Cloud Pages Spread ScreenConnect Malware

Gbhackers •Mayura Kathir • May 29, 2026

Hackers are actively exploiting trust in Adobe Document Cloud by using fake delivery pages to install remote access malware. The campaign leverages a sophisticated phishing kit named “RatPressto,” which abuses compromised WordPress sites and legitimate software to evade detection while targeting financial organizations. The attack begins with phishing emails that appear to be standard corporate […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Uses Fake Adobe Pages to Distribute ScreenConnect Malware A phishing campaign is targeting financial organizations by using counterfeit Adobe Document Cloud pages to install ScreenConnect malware on victim machines. The attackers exploit trust in Adobe's services, utilizing a sophisticated phishing kit named 'RatPressto' that leverages compromised WordPress sites to evade detection. Phishing emails are crafted to appear as legitimate corporate communications, making them difficult to identify. The operation is well-structured and poses a significant threat to enterprise security. Currently, there are no specific numbers of victims reported, but the campaign is ongoing and evolving. Security professionals are advised to remain vigilant against such deceptive tactics. 2 sources 62

Extracted Entities

Fake Adobe Document Cloud Pages Spread ScreenConnect Malware

The full story

Extracted Entities

Attack Types (2)

Industries (1)

MITRE ATT&CK (1)

Platforms (2)

Tools (2)