A phishing campaign leverages a fraudulent Adobe-themed website to deliver ScreenConnect remote access software to victims. Once executed, the attackers perform interactive operations deploying malicious binaries, including a credential harvester named password.exe. They exploit the ms-phone URI handler to launch the Phone Link app, attempting to socially engineer victims into linking their mobile devices to capture sensitive information such as notifications and authentication prompts. This multi-stage attack aims to establish persistence, steal credentials, and prepare for lateral movement within the network. Indicators include multiple file hashes, a suspicious domain, and a URL associated with the campaign. No CVE or vendor patch information is available, and no known exploits in the wild have been reported.

Successful execution of this phishing campaign can lead to unauthorized remote access via ScreenConnect, credential theft through the password.exe tool, and potential compromise of mobile device notifications and authentication prompts via social engineering. This can facilitate persistence on the victim system and enable lateral movement within the network, increasing the risk of broader compromise. However, there are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a phishing-based attack involving social engineering and malicious software delivery, mitigation should focus on user awareness training to recognize phishing attempts, blocking access to known malicious domains and URLs, and employing endpoint protection solutions capable of detecting ScreenConnect misuse and the identified malicious binaries. Monitoring for unusual use of the ms-phone URI handler and Phone Link application may also help detect attempts to exploit this vector. No official fixes or patches are indicated in the available data.