This threat involves a sophisticated phishing campaign where attackers send emails impersonating company employees with PDF attachments purportedly containing transaction receipts. The malicious PDF shows a fake Adobe Flash Player update prompt; if clicked, it downloads a VBS script that runs with administrator privileges. The script displays a decoy payment receipt and silently installs ScreenConnect remote management software via an MSI package. This installation provides persistent remote access, enabling attackers to execute commands, transfer files, and deploy further payloads using legitimate administrative tools, characteristic of Living-off-the-Land attacks.

Successful exploitation results in persistent remote access to the victim system via ScreenConnect software. Attackers gain the ability to execute arbitrary commands, transfer files, and deploy additional malicious payloads using legitimate administrative tools, potentially leading to full system compromise and data exfiltration.

No official patch or fix is available as this is a phishing campaign leveraging social engineering and legitimate software abuse. Mitigation focuses on user awareness to avoid opening suspicious email attachments and prompts. Organizations should monitor for unauthorized installations of remote management software like ScreenConnect and restrict execution of scripts with administrative privileges where possible. Employ email filtering to detect and block phishing emails with malicious PDF attachments.