Fake "View & Sign" and Adobe Acrobat Lures Deliver Attacker-Configured ScreenConnect Clients

This threat involves fake Adobe Acrobat and "View & Sign" phishing pages distributing legitimate, digitally signed ConnectWise ScreenConnect remote access clients configured by attackers for unauthorized access. The campaign uses Telegram bots to track visitors, profile devices and networks, and selectively deliver the remote-access clients based on operating system and ISP checks. The installed clients connect to various attacker-controlled ScreenConnect Cloud tenants and establish persistent remote access with LocalSystem privileges. The threat leverages trusted software with valid digital signatures to evade traditional security controls, requiring defenders to detect unauthorized tenant configurations rather than relying on file hashes.

• RSVP to Disaster: How One Click Installs a RATMalware2026-10-13
• How a single ScreenConnect incident exposed a massive campaignMalware2026-07-01
• Phishing Attack via Adobe-Themed Lure Delivering ScreenConnect and Credential Harvesting ToolsMalware2026-04-23
• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• Inside ICMacOS: From an Infostealer to a Persistent RATMalware2026-10-27