Cybercriminals Lure Victims with Fake Adobe Acrobat Document-Signing Pages

Don’t sign on the dotted line just yet. Or at least take care when using document-signing pages from Adobe Acrobat. CloudSEK found that cybercriminals are using fake pages to distribute ConnectWise ScreenConnect remote-access software to gain access to Windows systems. 

And traditional file-signature checks might not detect the risks.

In a recent investigation, CloudSEK identified a pair of digitally signed ScreenConnect installers whose configurations targeted separate remote access tenants. And though the legitimate installers weren’t trojanized, tk.

“CloudSEK’s Global Threat Intelligence platform, GTI, identified an Adobe Acrobat Reader-themed lure hosted at clickksy[.]icu was associated with downloads of two genuine, digitally signed ConnectWise ScreenConnect installers configured to connect to separate ScreenConnect Cloud tenants, omydze and vvvzou,” according to a CloudSEK report, which explained that “the installers were not identified as trojanized; the risk stems from their preconfigured remote-access settings. If installed, they could establish persistent remote access for an external operator.”

After analyzing another eight URLs that were connected to document-signing lures, the researchers found that five of them share almost identical JavaScript as well a background image in common. From the corrupt pages, information on visitors was sent to Telegram bots—that information included IP addresses, data on devices and browsers, location data, timestamps and details about ISPs. Once the OSs and ISPs had been checked, the pages automatically delivered ScreenConnect clients. 

The installers associated with Adobe, the report says, had been configured “for guest access and included relay details,” with “static MSI analysis showed an automatically starting service running as LocalSystem.” The researchers gave a high confidence rating to the potential of persistent remote access.

“No credential capture was observed” and “the presence of vendor credential-provider components alone does not demonstrate credential theft,” the report says, with “observed behavior and static configuration are consistent” with MITRE ATT&CK techniques around remote access software, Windows service, ingress tool transfer, encrypted channel and virtual/sandbox invasion.

While researchers didn’t observe any victims being compromised, the report warns, “executing a client configured for an unauthorized tenant could provide an external operator with persistent, interactive access to a Windows system.”

Depending on tenant permissions and subsequent operator activity, the report says, “this access could support data theft, exposure of user sessions, lateral movement, or delivery of additional tools.”

Their findings, they say, underscore that “valid vendor signatures do not make a remote-management client safe when it has been configured to connect to an unapproved tenant. Blocking only installer hashes is also unlikely to be sufficient because different tenants can generate different client builds.”

Shane Barney, CISO at Keeper Security, says that “the abuse of legitimate remote management software illustrates how attackers can avoid building bespoke malware by exploiting access and identity instead.”

By using genuine ScreenConnect installers to operate as trusted administrators, he says, “threat actors bypass traditional security perimeters completely,” activity, to conventional filters, “looks like approved enterprise administration rather than an active intrusion.”

The campaign observed by CloudSEK is particularly dangerous due to “how quickly social engineering translates into unconstrained control,” Barney says.

“When a user clicks a malicious document-signing lure and runs an installer, the real vulnerability is the excessive permissions that allow the attacker to establish persistent access with the highest possible endpoint privileges,” he says.

Security teams must be rigorous in their approach since, as Barney says, they “cannot rely solely on traditional endpoint,” explaining “organizations must shift from static verification to a zero-trust architecture driven by endpoint privilege management.” 

They should “check which accounts control existing remote-access installations and investigate any the company has not approved,” Soroko says. 

Noting that “if installed, the analyzed clients could provide continuing access through services configured to start with Windows,” he says, “checking the installer’s signature alone would miss the unauthorized connection.”

Employees, too, play an important role in defense. They “should verify any document-signing request that requires installing remote-control software. CloudSEK did not confirm any victim compromise, so these findings describe potential access rather than demonstrated intrusions,” says Soroko.

Defenders must eliminate “standing local administrative rights across the workforce. If an employee doesn’t hold the persistent permissions required to install a background service silently, neither does the attacker who tricks them,” says Barney.  

“In modern environments, identity is the primary attack surface; organizations must enforce least privilege by default and grant elevated access only when it is verified and immediately required,” he says.