Malicious Adobe Pages Distributing Remote Access Tool Identified

• •Attackers use fake Adobe Acrobat pages to distribute legitimate remote access software.
• •The campaign exploits digitally signed installers with unauthorized configurations.
• •CloudSEK has identified multiple tenant configurations linked to the malicious activity.

Cybersecurity researchers from CloudSEK have discovered a campaign using fake Adobe Acrobat pages to distribute legitimate ConnectWise ScreenConnect remote-access software. The attackers exploit digitally signed installers configured to connect to unauthorized tenants, potentially granting persistent access to Windows systems. The delivery mechanism involves deceptive document-review prompts that check visitor operating systems and collect sensitive information before automatically downloading the ScreenConnect client. The campaign has been linked to multiple tenant configurations, including omydze and vvvzou, with additional configurations identified. CloudSEK has not confirmed any victim compromises or the identity of the operators behind the campaign. Security teams are advised to monitor unauthorized ScreenConnect configurations and services.