Threat Advisory

Spam Campaign Distributes Fake PDFs Leading to Remote Access Tools

Threat: Phishing Campaign
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: High

EXECUTIVE SUMMARY:

A spam-based phishing campaign is actively exploiting users and organizations by distributing deceptive email attachments disguised as legitimate PDF documents. In this operation, threat actors craft emails that appear to come from trusted sources and include attachments with professional-sounding names like “Invoice_Details .pdf” or “Defective_Product_Order .pdf,” designed to elicit urgent attention from recipients. When users open these attachments, they aren’t presented with actual document content but rather a fabricated error message falsely claiming the file cannot be viewed. The message prompts the user to click a link to “open” or update the document through what appears to be an official Adobe Acrobat download page—a classic social engineering lure. Instead of genuine software, the link directs victims to pages hosting installers for Remote Monitoring and Management (RMM) tools. Because these tools are legitimate and digitally signed by reputable vendors, many security products don’t flag them, allowing attackers to bypass security controls and establish footholds.

The campaign’s technical execution centers on social engineering and misuse of legitimate administrative tools to achieve persistence and control. Upon opening the fake PDF, users see a static image or blurred message that mimics a document view error, with an embedded prompt or button urging them to proceed to a third-party site to “resolve” the issue—often purporting to be Adobe’s site. Clicking this leads to a malicious landing page controlled by the attackers, which hosts installers for enterprise-grade RMM software like ScreenConnect, Syncro, NinjaOne, or SuperOps. These RMM tools are typically used by IT administrators to monitor, manage, and troubleshoot systems remotely, but in this context they are deployed without authorization. Once installed, the RMM agent establishes a network connection to attacker-controlled infrastructure, granting full remote access. The attacker can execute commands, steal data, transfer files, monitor screens in real time, or deploy additional malware. Because the RMM tools are digitally signed and trusted, they often evade detection by antivirus or endpoint detection systems and blend with legitimate administrative traffic, enabling stealthy persistence even after system reboots.

The campaign demonstrates how malicious actors can leverage legitimate software and everyday file formats to bypass traditional security measures and compromise networks. Instead of relying on custom malware binaries that are easily detected, attackers rely on social engineering, trusted software, and user interaction to establish persistent access. This “living off the land” tactic increases the difficulty of detection, allowing attackers to stay under the radar while they explore compromised environments or execute follow-on actions. Organizations should treat any unexpected “update” or document-view request with caution, particularly when it originates from unsolicited emails. Security teams can mitigate risk by restricting installation of RMM tools to controlled IT-approved channels, monitoring network traffic for unauthorized remote access software, and educating employees on the dangers of interacting with suspicious email attachments.

THREAT PROFILE:

Tactic Technique ID Technique Sub-Technique
Reconnaissance T1598 Phishing for Information
Resource Development T1583 Acquire Infrastructure
T1587 Develop Capabilities
Initial Access T1566.001 Phishing Spearphishing Attachment
T1566.002 Phishing Spearphishing Link
Execution T1204.002 User Execution Malicious File
T1204.001 User Execution Malicious Link
Privilege Escalation T1548 Abuse Elevation Control Mechanism
Defense Evasion T1036 Masquerading
T1027 Obfuscated Files or Information
Discovery T1082 System Information Discovery
T1046 Network Service Discovery
Lateral Movement T1021 Remote Services
Collection T1113 Screen Capture
Command and Control T1219 Remote Access Tools
Exfiltration T1041 Exfiltration Over C2 Channel
Impact T1499 Endpoint Denial of Service

REFERENCES:

The following reports contain further technical details:

https://cybersecuritynews.com/spam-campaign-distributes-fake-pdfs/

https://x.com/spiderlabs/status/2019442251328258496?s=48

crossmenu