Threat actors conducted a complex web-based campaign impersonating trusted brands like DocuSign and using cloud services such as Cloudflare Pages with fake verification workflows to appear legitimate. Victims were tricked into downloading a ZIP archive containing a malicious HTA file that used Base64-encoded VBScript, fake Adobe UI elements, UAC privilege escalation, and Microsoft Defender SmartScreen registry changes. The attack utilized living-off-the-land techniques with native Windows utilities (mshta.exe, curl.exe, msiexec.exe) to silently install ConnectWise ScreenConnect Access clients, providing unauthorized remote access. The campaign was classified as Zero Hour Fraudulent and was blocked before payload delivery.

If successful, the attack would have resulted in unauthorized remote access to victim systems via silently installed ScreenConnect clients. This could allow threat actors to control affected machines remotely. However, the campaign was blocked at the web entry point, preventing payload delivery and exploitation.

The attack was blocked before payload delivery, indicating existing defenses were effective. Organizations should remain vigilant against social engineering lures impersonating trusted brands and monitor for suspicious downloads of ZIP archives containing HTA files. No specific patch is applicable. Maintaining updated endpoint protection and user awareness can help prevent similar attacks.