This threat involves phishing campaigns leveraging Vercel, a legitimate website hosting service, to host malicious pages impersonating Adobe PDF viewers. Victims receive phishing emails containing links to these pages, which prompt them to download an executable file disguised as a document (Invoice06092025.exe.bin). Upon execution, the malware installs LogMeIn remote access software, enabling attackers to gain persistent remote control over the infected systems. The campaigns have been active for at least two months with over 28 distinct campaigns and more than 1,271 targeted users. The attackers exploit the trust in Vercel-hosted content to evade detection and increase the likelihood of user compromise.

Successful execution of the malware results in the installation of remote access software (LogMeIn) on victim machines, allowing attackers to remotely control and potentially manipulate or exfiltrate data from compromised systems. The use of trusted hosting platforms like Vercel increases the difficulty of detecting the phishing pages, raising the risk of widespread compromise.

No official patch or fix applies as this is a phishing and malware distribution campaign abusing a legitimate hosting platform. Defenders should educate users to recognize phishing attempts and avoid downloading executables from untrusted sources, even if hosted on trusted platforms. Email filtering and URL reputation checks may help reduce exposure. Monitor for suspicious LogMeIn installations and unauthorized remote access activity. Since this is not a software vulnerability, patching is not applicable.