Fake Adobe Acrobat and document-signing pages deliver signed ScreenConnect clients tied to attacker-controlled tenants
CloudSEK researchers uncovered a campaign using fake Adobe Acrobat and document-signing pages ("View & Sign Form", "Sign in to view document") to deliver legitimate, digitally signed ConnectWise ScreenConnect clients preconfigured to connect to unauthorized tenants. Rather than trojanizing binaries, the attackers rely on genuine signed software with attacker-controlled configurations, which may give operators persistent access to Windows systems. CloudSEK has not confirmed any victim compromise or identified who operates the infrastructure.
Detalhes técnicos
- Landing pages check OS and device type, redirecting non-Windows desktop visitors, and collect public IP, geolocation, browser and ISP details, sending them to Telegram bots. ISP-based restrictions can block selected visitors from receiving the download, possibly to evade automated analysis (exact purpose not established).
- Visitors passing the checks automatically receive a ScreenConnect client.
- Adobe-themed domain clickksy.icu was registered on October 2, 2026 and received a wildcard Let's Encrypt certificate the same day; researchers could not retrieve the page directly due to a Cloudflare challenge.
- Two genuine signed installers are tied to ScreenConnect tenants omydze and vvvzou. Follow-up collection found three more tenant configurations: luminahealthturkey2, tfcconnection and alunos1 (signatures not independently verified).
- The two Adobe-associated installers install ScreenConnect services that start automatically and run as LocalSystem, per static analysis. This could enable data theft, lateral movement or deployment of additional software.
Remediação
- Look beyond file hashes: review DNS and proxy logs for connections to unknown ScreenConnect servers.
- Check Windows hosts for unexpected ScreenConnect services.
- Report suspicious tenant IDs to ConnectWise.
- Restrict ScreenConnect installations to approved tenants.
Linha do tempo
-
Fake Adobe Acrobat and document-signing pages deliver signed ScreenConnect clients tied to attacker-controlled tenants
ler a análise desta fonte ocultar
CloudSEK researchers uncovered a campaign using fake Adobe Acrobat and document-signing pages ("View & Sign Form", "Sign in to view document") to deliver legitimate, digitally signed ConnectWise ScreenConnect clients preconfigured to connect to unauthorized tenants. Rather than trojanizing binaries, the attackers rely on genuine signed software with attacker-controlled configurations, which may give operators persistent access to Windows systems. CloudSEK has not confirmed any victim compromise or identified who operates the infrastructure.
Technical Details
- Landing pages check OS and device type, redirecting non-Windows desktop visitors, and collect public IP, geolocation, browser and ISP details, sending them to Telegram bots. ISP-based restrictions can block selected visitors from receiving the download, possibly to evade automated analysis (exact purpose not established).
- Visitors passing the checks automatically receive a ScreenConnect client.
- Adobe-themed domain clickksy.icu was registered on October 2, 2026 and received a wildcard Let's Encrypt certificate the same day; researchers could not retrieve the page directly due to a Cloudflare challenge.
- Two genuine signed installers are tied to ScreenConnect tenants omydze and vvvzou. Follow-up collection found three more tenant configurations: luminahealthturkey2, tfcconnection and alunos1 (signatures not independently verified).
- The two Adobe-associated installers install ScreenConnect services that start automatically and run as LocalSystem, per static analysis. This could enable data theft, lateral movement or deployment of additional software.
Remediation
- Look beyond file hashes: review DNS and proxy logs for connections to unknown ScreenConnect servers.
- Check Windows hosts for unexpected ScreenConnect services.
- Report suspicious tenant IDs to ConnectWise.
- Restrict ScreenConnect installations to approved tenants.