Fake Acrobat Downloads Deliver Signed ScreenConnect Remote-Access Setup

Key points

• CloudSEK analysts traced a campaign using counterfeit Acrobat download portals.
• The installers are digitally signed and set up ScreenConnect remote access.
• Attackers gain access they control on Windows endpoints.
• No CVE has been assigned; treat this as a medium-severity risk.

Analysts at CloudSEK have documented a scheme in which cybercriminals stand up counterfeit download pages for Adobe's Acrobat software. Instead of the expected reader, visitors receive installers that carry valid digital signatures. Once executed, these packages configure ConnectWise's ScreenConnect tool so that remote access is established under the intruder's control.

The activity affects organizations whose users seek Acrobat downloads and run Windows endpoints, particularly environments where ScreenConnect is permitted. Because the installer is signed, ordinary signature checks may not flag it; the risk lies in what the software is configured to do after installation.

CloudSEK's findings show how trusted brands and legitimate remote-support software can be abused together. The absence of a CVE means defenders cannot rely on a patch identifier or scanner signature alone. The campaign blends social engineering, signed binaries and remote-access setup, making user reports and behavioral monitoring important.

IT teams should watch for Acrobat installers sourced from non-Adobe domains, unexpected ScreenConnect deployments, and new remote-access configurations on Windows hosts. Reviewing installer publisher details, hash reputation and ScreenConnect tenant or agent logs can reveal mismatches. Because severity is medium, prioritize containment and user awareness rather than emergency patching.

What to do now

1. Block or alert on Acrobat installer downloads from domains other than Adobe's official properties; inspect proxy and DNS logs for recent access to lookalike pages.
2. Inventory ScreenConnect agents and tenants; remove or disable unauthorized instances and restrict outbound connectivity to approved relay servers.
3. Hunt for newly installed signed binaries whose publisher or product details do not match Adobe, and validate hashes against approved software catalogs.
4. Review Windows endpoints for recent remote-access configuration changes, new services, scheduled tasks, and unusual inbound or outbound connections.
5. Enforce application allowlisting and endpoint detection rules for ScreenConnect installers launched from browser download folders or temporary paths.
6. Brief helpdesk staff and users to navigate directly to Adobe's site and report search-ad or emailed Acrobat download links.
7. Preserve evidence and isolate hosts showing intruder-controlled ScreenConnect sessions; rotate credentials and review remote-access logs.

Original source

Hackread