Fake Adobe and Document-Review Lures Deliver Tenant-Configured ScreenConnect Clients

Oct 29, 2026 · Original article ↗

Summary

CloudSEK linked fake document-review pages to genuine, signed ScreenConnect installers configured for unauthorized tenants. The pages profiled visitors and sent details to Telegram; no victim compromise was confirmed.

Key points

Two installers collected in the Adobe-themed investigation were digitally signed by ConnectWise and configured to connect to separate ScreenConnect tenants; the investigators did not identify them as trojanized.
Five related “View & Sign” page variants shared near-identical JavaScript and a background image, and automatically downloaded tenant-configured ScreenConnect clients when visitor checks allowed.
The pages checked operating system and ISP, collected visitor details, and sent notifications to Telegram bots. The ISP restrictions may limit automated analysis, but their intent is not conclusive.
Static MSI analysis found an automatically starting ScreenConnect service running as LocalSystem. No Windows execution or dynamic endpoint analysis was performed.
The evidence supports shared delivery tooling, but does not establish whether one or multiple operators were involved. The Adobe-themed page could not be retrieved for independent inspection.
No victim compromise was confirmed. CloudSEK recommends identifying unauthorized ScreenConnect tenants and services rather than relying on file hashes alone.

Article Details

Attack Vectors: Adobe Acrobat Reader-themed and “View & Sign Form” pages prompted visitors to download ScreenConnect clients configured for attacker-selected tenants.
The pages checked visitor operating system and device type, retrieved public IP and geolocation information, and sent visitor details to Telegram bots.
Pages used ISP-based restrictions and redirected some non-Windows visitors through motormotif[.]com/falscon; the final destination could not be confirmed.
The analyzed installers were configured for guest access and included relay details; static MSI analysis found an automatically starting service running as LocalSystem. No victim compromise or Windows execution was confirmed.
Defensive Notes: Identify ScreenConnect installations and tenant configurations that are not explicitly approved; investigate matching endpoints rather than relying on installer hashes alone.
Search proxy and DNS logs for the reported campaign domains and the ScreenConnect ClientSetup.exe download pattern, while avoiding broad blocking of shared ScreenConnect or Cloudflare infrastructure.
Alert on connections to instance-*-relay[.]screenconnect[.]com when the tenant is not approved, and investigate suspicious document-page requests to Telegram’s sendMessage API.
If an unauthorized client is found, isolate the endpoint, preserve evidence, remove the installation, rotate credentials accessible from the host, and review remote sessions and file transfers.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`clickksy[.]icu`	Adobe Acrobat Reader-themed lure domain associated with downloads of ScreenConnect installers.
DOMAIN	`greenandverified[.]site`	Domain associated with a “View & Sign Form” page variant delivering a tenant-configured ScreenConnect client.
DOMAIN	`intentionallydurable[.]site`	Domain associated with a “View & Sign Form” page variant delivering a tenant-configured ScreenConnect client.
DOMAIN	`intentionallyevaluated[.]site`	Listed by the investigation as a campaign domain.
DOMAIN	`interestinghub[.]site`	Domain associated with a “View & Sign Form” page variant delivering a tenant-configured ScreenConnect client.
DOMAIN	`prependinganalysis[.]site`	Domain associated with a “View & Sign Form” page variant delivering a tenant-configured ScreenConnect client.
DOMAIN	`testedinception[.]site`	Domain associated with a “View & Sign Form” page variant delivering a tenant-configured ScreenConnect client.
IPV4	`103[.]153[.]182[.]197`	IP address associated with the motormotif[.]com redirect path.
IPV4	`107[.]172[.]140[.]34`	Listed in the investigation’s origin IP indicators.
IPV4	`107[.]172[.]249[.]7`	Listed in the investigation’s origin IP indicators.
IPV4	`107[.]174[.]242[.]105`	Listed in the investigation’s origin IP indicators.
IPV4	`142[.]93[.]157[.]161`	Origin IP associated with the malicious page variant on prependinganalysis[.]site.
IPV4	`144[.]126[.]224[.]49`	Origin IP associated with the malicious page variant on greenandverified[.]site.
IPV4	`157[.]230[.]48[.]85`	Origin IP associated with the malicious page variant on testedinception[.]site.
IPV4	`161[.]35[.]120[.]164`	Origin IP associated with the malicious page variant on interestinghub[.]site.
IPV4	`167[.]99[.]232[.]192`	Origin IP associated with the malicious page variant on intentionallydurable[.]site.
IPV4	`172[.]245[.]145[.]8`	Listed in the investigation’s origin IP indicators.
IPV4	`192[.]255[.]139[.]9`	Listed in the investigation’s origin IP indicators.
IPV4	`192[.]3[.]109[.]170`	Listed in the investigation’s origin IP indicators.
SHA256	`1552fa772ad501e9b7024a0952bbc30637be23778896492e372a9aee463fa06a`	SHA-256 of an Adobe-lure MSI package configured to connect to an unapproved tenant.
SHA256	`56a0c57d46e182827f1356e566337f9fd54404f9637c19369b188c39d3d127d3`	SHA-256 of a follow-up installer with ScreenConnect configuration extracted for tenant alunos1; signature was not independently verified.
SHA256	`c7a4e83ae354d5c60acb878cc3a7c9fc06287e03a054fb7e8bc0b8fe6fa0a3f9`	SHA-256 of a follow-up installer with ScreenConnect configuration extracted for tenant tfcconnection; signature was not independently verified.
SHA256	`dcd9db5cfaa4d1351d6d54e1be1ab87a21bcd9289e966e79d550ebffb2903660`	SHA-256 of a follow-up installer with ScreenConnect configuration extracted for tenant luminahealthturkey2; signature was not independently verified.
SHA256	`e98a5f363645ab41597d73dc9df7859b154fb0a2a08e23623050c217e4f77d5d`	SHA-256 of an Adobe-lure ScreenConnect installer configured to connect to an unapproved tenant.