Fake Adobe Document Cloud Pages Spread ScreenConnect Malware

Hackers are actively exploiting trust in Adobe Document Cloud by using fake delivery pages to install remote access malware.

The campaign leverages a sophisticated phishing kit named “RatPressto,” which abuses compromised WordPress sites and legitimate software to evade detection while targeting financial organizations.

The attack begins with phishing emails that appear to be standard corporate document notifications. Victims receive a message claiming a secure file has been uploaded to Adobe Document Cloud due to size or confidentiality constraints. A “View File” link directs users to a compromised website hosting a fake Adobe-themed page.

Unlike traditional phishing that relies on attachments, RatPressto uses a staged web-based delivery system. The page displays a convincing “download complete” message, creating the illusion that a file has already been retrieved. Behind the scenes, a hidden iframe silently downloads a malicious payload without user awareness.

This payload typically installs ScreenConnect, a legitimate remote access tool repurposed as a remote access Trojan. Once deployed, attackers gain persistent access to infected systems, enabling data theft and further compromise.

FIRE said in a report shared with GBhackers, researchers observed that the phishing kit is highly reusable and consistent across campaigns. Multiple compromised WordPress sites hosted nearly identical phishing pages, differing only in victim-specific file names.

Attackers also rely heavily on legitimate services to reduce detection. GitHub is used to stage payloads, while ScreenConnect provides signed binaries that blend into normal enterprise traffic. This approach makes malicious activity harder to distinguish from legitimate administrative operations.

A notable weakness exploited in this campaign is poor WordPress security. Many compromised sites exposed publicly accessible administrative panels, suggesting attackers either obtained credentials or exploited vulnerable plugins to upload phishing content directly.

Fake Adobe Document Cloud Pages

The RatPressto campaign follows a structured infection process. After clicking the phishing link, victims are redirected to a compromised WordPress page hosting the fake Adobe interface.

The hidden iframe triggers automatic malware download, often delivering MSI installers, scripts, or executables.

In some cases, additional payloads are retrieved from attacker-controlled GitHub repositories. The malware then installs ScreenConnect silently using system commands that avoid user prompts.

Once active, the infected system connects to attacker-controlled infrastructure, enabling full remote control.

For example, a financial employee receiving a fake document notification may unknowingly install the tool, allowing attackers to monitor activity, capture credentials, and access internal systems without triggering alerts.

The campaign demonstrates a high level of operational maturity. Researchers identified consistent artifacts across deployments, including reused HTML structures, Adobe branding elements, and hidden iframe delivery mechanisms. Victim-specific payload naming further enhances credibility and targeting precision.

Additional features such as IP filtering, mobile device detection, and Cloudflare telemetry tracking show efforts to evade analysis and monitor victim interactions.

Infrastructure analysis suggests links to Brazil, with hosting and domain patterns pointing to São Paulo-based operations, although attribution remains at medium confidence.

The use of legitimate tools like ScreenConnect, alongside compromised infrastructure and social engineering, reflects a broader trend in modern cyberattacks.

Rather than developing custom malware, attackers increasingly rely on trusted software and reusable phishing kits to scale operations and bypass defenses.

Security teams are advised to monitor unusual use of remote access tools, secure WordPress administrative interfaces, and educate users about document-based phishing lures.

Indicators of Compromise (IOCs)

Category	Indicator
Domain	cloud.zistopstoabetterlife.com
Domain	iconclinic.ae
Domain	ampliawifi.com
Domain	gaheempreendimentos.com
Domain	vetcarebd.xyz
Domain	nabellacouture.com
Domain	birexo.icu
Domain	abpmed.com
Domain	c3po3090.com.br
Infrastructure IP	84.32.41.64
Infrastructure IP	177.154.191.148
File Artifact	ScreenConnect.ClientSetup.msi
File Artifact	microsoftceo.exe
File Artifact	ceo.msi

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.