Phishing Campaigns Delivering Malware via Disguised, Signed Installers and Malicious Attachments

Security researchers reported active phishing activity targeting enterprise users by impersonating routine workplace workflows (e.g., meeting invites, invoices, and document notifications) to trick recipients into running malware. One campaign used executables masquerading as Microsoft Teams, Zoom, and Adobe Acrobat Reader installers (e.g., msteams.exe, zoomworkspace.clientsetup.exe, adobereader.exe, invite.exe) that appeared trustworthy because they were digitally signed with an Extended Validation (EV) certificate issued to TrustConnect Software PTY LTD. Microsoft Defender telemetry attributed the activity to an unknown threat actor and assessed the approach as a deliberate, multi-wave effort designed to bypass user suspicion and basic security controls.

After execution, the signed malware deployed remote monitoring and management (RMM) tooling—reported examples include ScreenConnect, Tactical RMM, and Mesh Agent—to establish persistent remote access and enable follow-on actions across affected environments. Separately, reporting also highlighted phishing lures distributing malicious ISO attachments embedded in job application/resumé-themed emails, reinforcing that attackers continue to rely on socially engineered business processes (recruiting and HR workflows in particular) to deliver initial payloads and gain a foothold.