phishing-campaign-intelligenceremote-access-implantpersistence-methodidentity-impersonation-fraud

Phishing Pages Impersonate Adobe to Deploy Rogue ScreenConnect Clients

Social Engineering & Fraud · 2 sources · Updated 2mo ago · First seen Sep 9, 2026

Huntress investigated two late-August phishing intrusions in which attackers used browser-in-the-browser (BiTB) pages impersonating Adobe Acrobat or Reader to convince victims to install unauthorized ScreenConnect remote-management clients. Victims were led through malicious links and fake CAPTCHA or PDF-viewer lures to counterfeit Adobe browser windows that displayed the legitimate-looking get.adobe.com address within page content.

In each incident, the initial ScreenConnect installation downloaded and installed a second rogue ScreenConnect client, providing redundant service-based persistence and remote-access channels. The attackers also ran HideCursor.exe or HideUL.exe to conceal interactive activity; Huntress contained both intrusions before additional compromise. Microsoft Defender detected a command associated with patch.msi in one case but did not stop deployment of the second ScreenConnect client.

Is your org in this campaign?Get the infrastructure and lures behind it.

Hunt this campaign

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Aug 25, 2026 – Aug 31, 2026

Aug 31, 20262mo ago
Second BiTB phishing incident delivers redundant rogue ScreenConnect clients
On August 31, a victim interacted with a phishing message delivered through AT&T Office@Hand that led to the same fake Adobe Reader browser-in-the-browser template. An Adobe-update-themed installer deployed a ScreenConnect client, which retrieved a second client; both were registered as Windows services, and the actor ran HideUL.exe after deployment.
Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence | Huntress
Aug 25, 20263mo ago
Huntress detects BiTB phishing and rogue ScreenConnect in first incident
On August 25, Huntress detected malicious activity after a Gmail user followed a phishing link through fake CAPTCHA and Adobe PDF Reader browser-in-the-browser pages. The victim installed a rogue ScreenConnect client that downloaded a second client, established redundant service-based persistence, and was used to run HideCursor.exe.
Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence | Huntress

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

1 linked

ScreenConnect

Affected products

1 linked

Screenconnect

Observables

18 linked

Domain••••••.comURLhttps://••••••.•••/•••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

IPv4 address•••.•••.••.•••Domain••••••••••.comURLhttps://••••••••••.•••/•••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Domain••••••.ru+10

Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.

Hunt This Campaign

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

CyberveilleNews · Sep 9, 2026

Phishing BiTB + ScreenConnect rogues : deux incidents analysés par Huntress en août 2026 | CyberVeilleOpen source ↗

Huntress BlogNews · Sep 9, 2026

Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence | HuntressOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

phishing-campaign-intelligenceremote-access-implantpersistence-methodidentity-impersonation-fraud

Phishing Pages Impersonate Adobe to Deploy Rogue ScreenConnect Clients

Social Engineering & Fraud · 2 sources · Updated 2mo ago · First seen Sep 9, 2026

Is your org in this campaign?Get the infrastructure and lures behind it.

Hunt this campaign

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Aug 25, 2026 – Aug 31, 2026

Aug 31, 20262mo ago
Second BiTB phishing incident delivers redundant rogue ScreenConnect clients
On August 31, a victim interacted with a phishing message delivered through AT&T Office@Hand that led to the same fake Adobe Reader browser-in-the-browser template. An Adobe-update-themed installer deployed a ScreenConnect client, which retrieved a second client; both were registered as Windows services, and the actor ran HideUL.exe after deployment.
Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence | Huntress
Aug 25, 20263mo ago
Huntress detects BiTB phishing and rogue ScreenConnect in first incident
On August 25, Huntress detected malicious activity after a Gmail user followed a phishing link through fake CAPTCHA and Adobe PDF Reader browser-in-the-browser pages. The victim installed a rogue ScreenConnect client that downloaded a second client, established redundant service-based persistence, and was used to run HideCursor.exe.
Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence | Huntress

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

1 linked

ScreenConnect

Affected products

1 linked

Screenconnect

Observables

18 linked

Domain••••••.comURLhttps://••••••.•••/•••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

IPv4 address•••.•••.••.•••Domain••••••••••.comURLhttps://••••••••••.•••/•••••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Domain••••••.ru+10

Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.

Hunt This Campaign

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

CyberveilleNews · Sep 9, 2026

Phishing BiTB + ScreenConnect rogues : deux incidents analysés par Huntress en août 2026 | CyberVeilleOpen source ↗

Huntress BlogNews · Sep 9, 2026

Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence | HuntressOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Phishing Pages Impersonate Adobe to Deploy Rogue ScreenConnect Clients

How this story unfolded

Second BiTB phishing incident delivers redundant rogue ScreenConnect clients

Huntress detects BiTB phishing and rogue ScreenConnect in first incident

Related entities

Malware

Affected products

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue ScreenConnect Clients

Hijacked ScreenConnect Clients Spread Worm-Like Malware to Remote Support Systems

Fake Adobe Acrobat and Signing Pages Deliver Attacker-Configured ScreenConnect Clients

Phishing Pages Impersonate Adobe to Deploy Rogue ScreenConnect Clients

How this story unfolded

Second BiTB phishing incident delivers redundant rogue ScreenConnect clients

Huntress detects BiTB phishing and rogue ScreenConnect in first incident

Related entities

Malware

Affected products

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue ScreenConnect Clients

Hijacked ScreenConnect Clients Spread Worm-Like Malware to Remote Support Systems

Fake Adobe Acrobat and Signing Pages Deliver Attacker-Configured ScreenConnect Clients