Attackers operate a social engineering campaign leveraging lookalike websites mimicking popular brands to distribute O&O Syspectr, a legitimate remote administration software. The installers are digitally signed and pre-linked to attacker-controlled Syspectr accounts, enabling remote access to victim PCs once installed. Multiple Syspectr account IDs are embedded in the filenames, separating campaigns by lure type (news sites vs. crypto mining games). The campaign targets Windows users and uses legitimate software to evade antivirus detection. O&O Software mitigated the abuse by disabling Remote Desktop and Remote Console access for free accounts and suspending the malicious accounts.

Successful installation of the maliciously configured O&O Syspectr software grants attackers remote access to victim Windows computers, potentially allowing unauthorized control and data access. The use of legitimate, digitally signed software reduces the likelihood of detection by security products. The campaign's social engineering tactics increase the risk of user compromise.

O&O Software has disabled Remote Desktop and Remote Console access for free Syspectr accounts and suspended the attacker-controlled accounts, effectively mitigating the abuse of their platform. Users should avoid downloading software from unofficial or suspicious websites, especially lookalike domains impersonating trusted brands. No patch is applicable since the threat leverages legitimate software misuse rather than a software vulnerability.