Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence
Source AlienVault OTX General
Description
Two sophisticated phishing campaigns employed browser-in-the-browser (BiTB) techniques to deceive victims into installing rogue ScreenConnect remote management tools. Attackers sent phishing messages with malicious links redirecting targets to fake Adobe Reader update pages. The BiTB technique created convincing fake browser windows within webpages, displaying legitimate-looking Adobe URLs to bypass user awareness training. Victims were tricked into downloading ScreenConnect installers disguised as Adobe software updates. Each incident resulted in deployment of multiple rogue ScreenConnect instances for redundant persistence, followed by execution of defense-evasion binaries (HideCursor.exe and HideUL.exe) designed to hide attacker activities. The attacks established service-based persistence through Windows services, enabling continued remote access. Both campaigns were intercepted before further damage occurred, demonstrating how threat actors combine social engineering throughout the entire attack chain...
Impact
If successful, the attacks would have allowed threat actors to gain persistent remote access to victim systems via rogue ScreenConnect installations, evade detection using specialized binaries, and maintain control through Windows service persistence. However, both campaigns were intercepted before further damage, preventing exploitation.
Defensive guidance
No official patch or fix applies as this is a social engineering and malware deployment campaign. Mitigation focuses on user awareness training to recognize BiTB phishing techniques, blocking known malicious URLs and hashes associated with these campaigns, and monitoring for unauthorized ScreenConnect installations and suspicious Windows services. Since the campaigns were intercepted early, no urgent remediation is required beyond standard phishing defenses and endpoint monitoring.
Summary
These phishing campaigns leveraged the browser-in-the-browser (BiTB) technique to create convincing fake browser windows within webpages, displaying legitimate Adobe URLs to deceive users. Victims were redirected to fake Adobe Reader update pages and tricked into downloading ScreenConnect installers masquerading as software updates. The attackers deployed multiple rogue ScreenConnect instances to maintain redundant persistence and executed defense-evasion binaries (HideCursor.exe and HideUL.exe) to hide their activities. Persistence was achieved through Windows service creation, allowing ongoing remote access. The campaigns were detected and stopped before additional harm occurred.
MITRE ATT&CK techniques
- T1566Phishing · Initial Access (opens in a new tab)
- T1566.002Phishing: Spearphishing Link · Initial Access (opens in a new tab)
- T1059Command and Scripting Interpreter · Execution (opens in a new tab)
- T1059.003Command and Scripting Interpreter: Windows Command Shell · Execution (opens in a new tab)
- T1204User Execution · Execution (opens in a new tab)
Indicators of compromise
Domains 6
- adoube.vu
- selectstructure.com.au
- relay.goldenmelon.us
- relay.illuminantgroup.net
- scx.illuminantgroup.net
- wir.consultingics.com
URLs 4
- http://adoube.vu/2a8ed9baefcd
- http://adoube.vu/filedocacess/file.html
- http://selectstructure.com.au/freedom/adobedocument.html
- http://wir.consultingics.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&c=GOODVIBE&c=&c=&c=&c=&c=&c=&c=