This investigation reveals a tech-support scam leveraging legitimate remote-access software UltraViewer and bulk-mailing software UltraMailer. A QuickBooks phishing campaign uses over 350 lookalike domains and tracking domains to direct victims to scammers attempting credential theft. UltraMailer is abused as a spamming tool with no abuse-reporting mechanism and is promoted on criminal forums. Trojanized installers containing authentic UltraViewer and UltraMailer copies, including one with njRAT malware, were found. The campaign briefly switched to another mailing service but resumed using UltraMailer after suspension. There is no evidence of developer involvement, but the findings highlight widespread criminal misuse of legitimate applications.