Investigating Abuse of Remote Desktop and Bulk Mailing Apps

This investigation reveals a tech-support scam leveraging legitimate remote-access software UltraViewer and bulk-mailing software UltraMailer. A QuickBooks phishing campaign uses over 350 lookalike domains and tracking domains to direct victims to scammers attempting credential theft. UltraMailer is abused as a spamming tool with no abuse-reporting mechanism and is promoted on criminal forums. Trojanized installers containing authentic UltraViewer and UltraMailer copies, including one with njRAT malware, were found. The campaign briefly switched to another mailing service but resumed using UltraMailer after suspension. There is no evidence of developer involvement, but the findings highlight widespread criminal misuse of legitimate applications.

• Inside SiriusQT: A Seriously Skilled RATMalware2026-10-22
• KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and TerrorizeMalware2026-10-15
• Grand Theft Auto VI hype leads to malwareMalware2026-09-09
• Illegal Streaming Fronts a $7M Dropcatch Domain OperationMalware2026-08-13
• Still Circling: Toolkit Keeps EvolvingMalware2026-07-18