Phishing Campaign Uses Fake Software Updates To Install Remote Access Tools

This campaign represents a multi-stage intrusion chain that relies on:

• social engineering (phishing emails)
• trusted execution (digitally signed binaries)
• living-off-the-land techniques (PowerShell, msiexec)
• legitimate tools abused for persistence (RMM software)

Instead of exploiting vulnerabilities, attackers exploit trust in software, branding, and digital signatures.

1. Phishing Email Delivery

Victims receive phishing emails disguised as workplace communications, such as:

• meeting invitations
• project proposals
• financial or internal documents

These emails typically include a PDF attachment or a download link.

2. Malicious PDF Lure

In this scenario, opening the PDF does not display a document but instead presents a blurred image indicating the file cannot be viewed directly. The interface contains a button labeled “Open in Adobe”, which redirects victims to a spoofed download page mimicking Adobe’s official site.

3. Spoofed Adobe Download Page

The victim is redirected to a page mimicking Adobe’s official website.

The page claims that Adobe Acrobat Reader is outdated and prompts the user to download an update.

4. Malware Delivery (Signed Executable)

The downloaded file masquerades as legitimate software installers, such as:

msteams.exe

adobereader.exe

zoomworkspace.clientsetup.exe

invite.exe

These executables are digitally signed using an Extended Validation (EV) certificate issued to TrustConnect Software PTY LTD, increasing their perceived legitimacy and helping bypass security controls.

5. Meeting-Themed Phishing Variant

Another variation of the campaign uses collaboration tool lures, where attackers impersonate platforms such as Microsoft Teams and Zoom.

Victims are prompted to download meeting-related files such as transcripts or shared documents.

6. Spoofed Collaboration Tool Download Pages

Victims are redirected to fake download portals mimicking legitimate collaboration tools.

These pages closely resemble official software distribution sites.

7. Persistence and System Modification

Once executed, the malware performs several actions designed to ensure persistence and stealth. The executable copies itself to C:\Program Files, reinforcing the illusion that it is a legitimate system-installed application. It then registers itself as a Windows service, ensuring it launches automatically during system startup.

• Persistence is further strengthened through the creation of a registry Run key:
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• Value Name: TrustConnectAgent
• Executable Path: C:\Program Files\Adobe Acrobat Reader\AdobeReader.exe

8. Payload Staging via PowerShell

After establishing persistence, the malware initiates encoded PowerShell commands to retrieve additional payloads from attacker-controlled infrastructure.

Examples of these commands are shown in:

The PowerShell commands download ScreenConnect client installer files (.msi) and stage them in temporary directories. The Windows msiexec.exe utility is then invoked to install the ScreenConnect application.

During installation, the ScreenConnect backdoor creates multiple registry entries and service configurations designed to maintain persistence and enable reconnection to attacker infrastructure after system restarts.

The installed ScreenConnect components include executables located in directories such as:

C:\Program Files (x86)\ScreenConnect Client [Client ID]

These entries contain encoded parameters including connection identifiers, session tokens, and server addresses used for command-and-control communication.

9. RMM Backdoor Deployment

In addition to ScreenConnect, the malware deploys additional remote monitoring and management frameworks to increase operational redundancy.

Specifically, encoded PowerShell commands download and install Tactical RMM, which subsequently installs MeshAgent, providing another remote access mechanism.

The deployment of these additional tools is illustrated in:

The use of multiple RMM frameworks ensures that attackers retain access even if one backdoor is detected or removed. It also provides flexibility in command execution, lateral movement, and persistence within compromised networks.

10. Command and Control

The malware communicates with attacker-controlled infrastructure, including:

• trustconnectsoftware[.]com
• multiple associated domains and IPs

Attackers maintain access through centralized management panels.

The following techniques were observed across this campaign:

This campaign relies on trusted execution and legitimate tooling, so detection should focus on abnormal combinations of activity, not single indicators.

From a SOC Perspective

Focus on identifying suspicious execution chains and tool misuse:

• Monitor execution of user-downloaded installers mimicking enterprise apps:
  • msteams.exe, adobereader.exe, zoomworkspace.clientsetup.exe
• Detect PowerShell activity triggered shortly after file downloads
  • especially encoded commands or child processes from user directories
• Identify msiexec.exe spawning from non-standard parent processes
• Alert on multiple RMM tools installed on the same endpoint
  • ScreenConnect
  • Tactical RMM
  • MeshAgent
• Monitor new service creation + registry Run key additions
  • especially under:
    • HKLM\Software\Microsoft\Windows\CurrentVersion\Run
• Correlate endpoint + network activity
  • outbound connections following execution of suspicious installers
  • communication with unknown external domains

From an Awareness Perspective

Enterprise applications should not be installed from email-delivered content

Documents prompting actions such as:

• “Open in Adobe”
• “Download update”

!   should be treated as suspicious

Unexpected meeting-related attachments or software prompts should always be verified before interaction

This campaign impacts multiple layers of the environment due to its reliance on user execution and legitimate tooling:

• Endpoints (Windows)
  Primary impact through execution of disguised installers, persistence mechanisms, and RMM deployment
• Identity & Access
  Potential exposure of credentials and active sessions, especially through browser access and remote control capabilities
• Remote Administration Tools
  Abuse of legitimate RMM solutions (e.g., ScreenConnect, Tactical RMM, MeshAgent) to maintain persistent access
• Email & Collaboration Platforms
  Used as the initial delivery vector through phishing emails impersonating workplace communications

This campaign demonstrates how attackers can achieve full compromise without exploiting a single vulnerability.

Instead of relying on exploits, the attack chain is built on:

• user-driven execution
• trusted software signatures
• legitimate administrative tools

This makes the activity significantly harder to distinguish from normal enterprise behavior.

Because the tools involved are commonly used in IT operations, malicious activity can blend into:

• routine software installations
• remote administration tasks
• normal user actions

The use of multiple RMM tools further increases attacker resilience, allowing access to persist even if part of the activity is detected and removed.

Wizard Cyber supports organizations in addressing campaigns like this through:

• Threat Intelligence (CSI):
  tracking emerging abuse of trusted software, signing mechanisms, and administrative tooling
• Detection & Monitoring:
  identifying abnormal execution patterns and unauthorized use of remote access tools
• Response & Guidance:
  supporting investigation, containment, and user awareness aligned with real attacker techniques