Hackers Use Fake Adobe Document Cloud Pages to Deliver ScreenConnect Malware

Cybersecuritynews •Tushar Subhra Dutta • May 29, 2026

A sophisticated phishing campaign is actively targeting financial organizations by using fake Adobe Document Cloud pages to silently install ScreenConnect remote access malware on victim machines. The operation is well-structured, deceptive, and difficult to detect because it blends into everyday enterprise software activity. The campaign works by sending phishing emails that look like legitimate Adobe […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Uses Fake Adobe Pages to Distribute ScreenConnect Malware A phishing campaign is targeting financial organizations by using counterfeit Adobe Document Cloud pages to install ScreenConnect malware on victim machines. The attackers exploit trust in Adobe's services, utilizing a sophisticated phishing kit named 'RatPressto' that leverages compromised WordPress sites to evade detection. Phishing emails are crafted to appear as legitimate corporate communications, making them difficult to identify. The operation is well-structured and poses a significant threat to enterprise security. Currently, there are no specific numbers of victims reported, but the campaign is ongoing and evolving. Security professionals are advised to remain vigilant against such deceptive tactics. 2 sources 62

Extracted Entities

Hackers Use Fake Adobe Document Cloud Pages to Deliver ScreenConnect Malware

The full story

Extracted Entities

Attack Types (2)

Industries (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)