Signed malware posing as Teams and Zoom apps drops RMM backdoors

A wave of phishing campaigns that used signed malware posing as popular workplace apps like Microsoft Teams, Zoom, and Adobe Reader to deploy remote monitoring and management (RMM) backdoors.

The activity, attributed to an as-yet unidentified threat actor, highlights how trusted branding and valid-looking digital signatures can be abused to gain stealthy, long-term access in enterprise networks.

According to Microsoft, the campaigns relied on convincing phishing emails that spoofed common workplace themes such as meeting invitations, invoices, project bids, and internal notifications.

In February 2026, Microsoft Defender Experts identified multiple phishing campaigns attributed to an unknown threat actor.

Messages either attached counterfeit PDFs or embedded links that redirected users to attacker-controlled download pages closely mimicking legitimate Adobe, Teams, or Zoom portals.

Victims were encouraged to “update” or “open” documents via prominent buttons and prompts, which instead delivered Windows executables masquerading as trusted apps, including msteams.exe, trustconnectagent.exe, adobereader.exe, zoomworkspace.clientsetup.exe, and invite.exe.

These binaries were digitally signed using an Extended Validation (EV) certificate issued to TrustConnect Software PTY LTD, giving them an appearance of strong authenticity and helping them bypass user suspicion and some controls that prioritize signed code.

The site automatically downloaded what appeared to be an Adobe Acrobat Reader update, but the installer was actually a TrustConnect-signed RMM package, not a legitimate Adobe build.

In the PDF-based flow, opening the attachment displayed a blurred, fake protected document with a red “Open in Adobe” button that redirected to a spoofed Adobe download center.

A similar pattern was observed in Teams and Zoom-themed campaigns, where fake meeting transcripts or update prompts pushed “out-of-date” installers that were in reality RMM payloads signed with the same EV certificate.

RMM backdoors and persistence

Once executed, the fake workplace applications deployed multiple RMM frameworks, including ScreenConnect, Tactical RMM, and MeshAgent, to establish durable remote access.

In one observed campaign, victims received the following email which included a fake PDF attachment that when opened shows the user a blurred static image designed to resemble a restricted document.

One observed binary, a workspace-style app signed as TrustConnect, first copied itself from the user’s Downloads directory into C:\Program Files to appear like a normal installed program, then registered as a Windows service to ensure startup persistence.

It also created a Run key under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run with the value TrustConnectAgent pointing to C:\Program Files\Adobe Acrobat Reader\AdobeReader.exe, further reinforcing the disguise.

The service initiated outbound connections to the attacker-controlled domain trustconnectsoftware[.]com, acting as the primary command-and-control (C2) endpoint.

From there, encoded PowerShell commands retrieved ScreenConnect client MSI installers into temporary directories and invoked msiexec.exe to complete installation.

Microsoft notes that in these cases, on-premises ScreenConnect MSI installers were unsigned by default, while the dropped ScreenConnect executables themselves carried revoked code-signing certificates, a pattern previously linked to misuse of on-prem RMM builds.

Forensics showed extensive ScreenConnect Client registry entries across multiple hives, including Windows service keys such as HKLM\SYSTEM\ControlSet001\Services\ScreenConnect Client [client ID], with configuration strings referencing ScreenConnect.ClientService.exe under C:\Program Files (x86)\ScreenConnect Client [Client ID].

These entries contained encoded identifiers, callback tokens, C2 addresses, and authentication parameters, providing reliable persistence, stealthy reconnection, and continuous C2 availability characteristic of a repurposed ScreenConnect backdoor rather than a standard IT deployment.

In parallel, additional encoded PowerShell stages deployed Tactical RMM and MeshAgent to diversify RMM channels and maintain access even if one tool was detected or removed.

Mitigations

Microsoft recommends organizations treat unapproved RMM activity and unexpected signed installers as high-risk and implement strict controls for remote management tools.

The resulting downloads masqueraded as Teams, Zoom, or Google Meet installer were in fact remote monitoring and management (RMM) software.

Administrators should follow Microsoft’s technique profile on abuse of RMM tools and use Windows Defender Application Control or AppLocker to block non-approved IT management binaries and publisher certificates, including untrusted or compromised software signing chains.

Enforcing multifactor authentication on legitimate RMM platforms, enabling cloud-delivered protection, Safe Links, Safe Attachments, and Zero-hour auto purge for email, and turning on attack surface reduction rules for script-based payloads and untrusted executables can significantly reduce exposure to similar signed-malware campaigns.

Defender for Endpoint customers can also use certificate block actions to prevent execution of specific signed applications and should hunt for unusual RMM installations, outbound connections to domains like trustconnectsoftware[.]com, and suspicious PowerShell-driven MSI deployments.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.