Fake Adobe Reader Download Drops ScreenConnect via Fileless Loader

A deceptive campaign in which attackers distributed a fake Adobe Acrobat Reader installer that secretly deployed ConnectWise’s ScreenConnect via a complex in‑memory execution chain.

Although ScreenConnect is a legitimate remote‑access tool, it was repurposed for unauthorized system control and data collection.

The attack chain started when victims landed on a phishing site designed to mimic Adobe’s official download page.

Once the site was accessed, a malicious VBScript file named Acrobat_Reader_V112_6971.vbs was automatically downloaded.

This script acted as the first‑stage loader and was heavily obfuscated to avoid detection. Instead of showing readable code, the attackers dynamically reconstructed strings and objects at runtime to hide operations like creating WScript.Shell, making static analysis nearly impossible.

In February 2026, Zscaler ThreatLabz discovered an attack chain where attackers used a fake Adobe Acrobat Reader download to lure victims.

The VBScript loader executed a PowerShell command with ExecutionPolicy Bypass, allowing the payload to run even on systems configured to block scripts.

PowerShell then created a temporary directory, fetched an additional file from Google Drive, and compiled it directly in memory using the Add‑Type command with .NET libraries.

This approach ensured that no malicious binaries were written to disk, minimizing forensic evidence and evading signature‑based defenses.

Reflection‑Based In‑Memory Loader

The second‑stage PowerShell component loaded and executed a hidden .NET assembly entirely in memory. Within this component, a HelloWorld class contained an embedded byte array representing the actual payload.

The loader used .NET reflection, calling Assembly.Load(byte[]) and EntryPoint.Invoke(), to dynamically execute the malicious assembly.

By splitting and concatenating method names like “Lo” + “ad” and “Ent” + “ryPo” + “int,” attackers concealed critical strings from automated analysis.

Advanced evasion techniques also appeared at this stage. The loader retrieved the Process Environment Block (PEB) to spoof the process name and mask its identity from monitoring tools.

It replaced the legitimate process metadata with values such as C:\Windows\winhlp32.exe, helping the malware blend into normal system activity and evade endpoint detection and response (EDR) solutions.

To gain administrator privileges without triggering a User Account Control (UAC) prompt, ThreatLabz found the attackers exploited Windows auto‑elevated Component Object Model (COM) objects.

They built an elevation moniker stored in reverse to obscure it to silently request elevated access using the CoGetObject function. If successful, this allowed the malicious process to execute with high privileges, bypassing standard security prompts.

Final Payload: ScreenConnect

In the last stage, another PowerShell command downloaded a renamed ScreenConnect installer from x0[.]at/qOfN.msi and executed it with msiexec.

Once installed, ScreenConnect granted the attackers remote access and full control over the compromised host. The chain concluded with the loader releasing its elevated COM object and terminating quietly.

Zscaler ThreatLabz concluded that the campaign demonstrates how legitimate IT tools can be weaponized through advanced scripting and memory‑only execution.

By combining layered obfuscation, dynamic code generation, and COM‑based privilege escalation, attackers successfully installed ScreenConnect without triggering traditional antivirus or EDR alerts.

The incident reinforces the need for behavioral‑based defenses and heightened scrutiny of “trusted” software downloads that originate outside official vendor domains.

Indicators Of Compromise (IOCs)

Indicator	Type
E4B594A18FC2A6EE164A76BDEA980BC0	VBS
07720d8220abc066b6fdb2c187ae58f5	VBS
c36910c4c8d23ec93f6ae7d7a2496ce5	VBS
3EFFADB977EDDD4C48C7850C8DC03B13	C# code with .NET assembly
07F95FF34FB330875D80AFADCA3F0D5B	C# code with .NET assembly
A7E5DBEC37C8F431D175DFD9352DB59F	C# code with .NET assembly
C02448E016B2568173DE3EEDADD80149	EXE
3D389886E95F00FADE1EEA67A6C370D1	MSI
eshareflies[.]im/ad/	Fraudulent page URL
https://x0[.]at/qOfN.msi	ScreenConnect installer download
drive.google[.]com/uc?id=1TVJir-OlNZrLjm5FyBMk_hDjG9BV1zCy&export=downloadcccccdcjeegrekhllfijllutvbrrcifehuenfirtelit	TXT download
drive.google[.]com/uc?id=1pyyQRpUmH0YtPG-VqvMNzKUo9i8-RZ7L&export=download	TXT download
drive.google[.]com/uc?id=1xuJR29UP5VcY6Nvwc7TDtt7fmcGGqIVc&export=download	TXT download

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.