Researchers Trace UltraViewer and UltraMailer Abuse to QuickBooks Phishing and Trojanized Installers
Summary
Infoblox traced a QuickBooks phishing campaign using UltraMailer’s chanret[.]com tracker across more than 350 lookalike domains, and found trojanized UltraMailer and UltraViewer installers carrying njRAT and DarkKometa. Researchers found no evidence implicating either’s
Key points
- The QuickBooks phishing campaign used more than 350 lookalike domains and urged recipients to call scammers seeking QuickBooks credentials.
- Emails contained a tracking pixel hosted on chanret[.]com; its URL encoded a campaign identifier and the recipient’s email address.
- After Mail250 suspended the reported account and the campaign stopped, the actor returned to the chanret[.]com tracker.
- A trojanized UltraMailer installer contained an njRAT payload; 45 of 75 VirusTotal vendors detected it as malicious.
- A trojanized UltraViewer installer was attributed to Win32.Comet.A, also known as DarkKometa, and installed under a name impersonating the Synaptics touchpad driver.
- Hexastrike linked DUC FABULOUS CO.,LTD to activity attributed to Silver Fox; Infoblox could not independently corroborate that a signing certificate’s private key was stolen or compromised.
- Infoblox found no evidence that UltraViewer or UltraMailer’s developers participated in the scams or malware distribution.
Article Details
- Attack Vectors
- QuickBooks-impersonation emails direct recipients to call scammers who attempt to steal QuickBooks credentials.
- Phishing emails use a 1×1 tracking pixel on chanret.com; opening the message sends a request that exposes recipient information.
- Tech-support scammers direct victims to install UltraViewer to provide remote access to their computers.
- Trojanized installers of UltraMailer and UltraViewer bundle remote-access malware; one UltraViewer sample disguises itself as Synaptics.exe under C:\ProgramData\Synaptics.
- Defensive Notes
- Organizations without a business need for UltraViewer should consider restricting access to prevent unauthorized access.
- Mail250 suspended the reported account, after which the observed campaign stopped; the article reports no comparable abuse-reporting mechanism on the UltraMailer website.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | qbcares[.]com | Identified as a QuickBooks-lookalike domain used in the phishing campaign. |
| HOSTNAME | smtracking[.]qbcares[.]com | Tracking hostname the campaign shifted to in August 2026. |
| HOSTNAME | track[.]chanret[.]com | Tracking-pixel hostname used in the QuickBooks phishing campaign to record message opens and identify recipients. |
| SHA256 | 28f046d9f985e58cbc8b245b54d4179feacecc12f41e2f6594306867ce3e8727 | Hash of a trojanized UltraViewer installer attributed to the Win32.Comet.A family. |
| SHA256 | 9e1a679ca45a149d2bd681cbb8ec3b1cc3d271fad51b092a3db5e5642eb6676b | Hash of a trojanized UltraMailer installer containing an embedded njRAT payload. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationA trojanized UltraViewer installer places the malware at C:\ProgramData\Synaptics\Synaptics.exe, impersonating the Synaptics touchpad driver.T1204.002 · Malicious FileThe trojanized UltraMailer and UltraViewer installers require a user to download and run a malicious file.T1219 · Remote Access ToolsTech-support scammers direct victims to install UltraViewer, a remote-access application used to give the scammers access to the victim's computer.T1566 · PhishingThe campaign sends phishing emails impersonating QuickBooks support and directs recipients to call scammers.
Threat Actors
Malware
njRATOne malicious UltraMailer installer carried njRAT, potentially infecting people who downloaded this illegitimate version of the mailing software with a remote access trojan.Win32.Comet.Ato VirusTotal on September 4, 2026, detected as malicious by 60 of 76 vendors and attributed to the Win32.Comet.A family, also known as DarkKometa.
Vendors
DUC FABULOUS CO.,LTDThis trojanized installer is unsigned but contains an authentic copy of Ultramailer with a DUC FABULOUS CO.,LTD Sectigo certificate (936BB9B6A2F8E1CD149B33F4A16D8A927CD675DE).Mail250When the same QuickBooks actor briefly moved to bulk-mail provider Mail250, Mail250 suspended the account after we reported the activity and the campaign stopped.
Products
QuickBooksDNS and email analysis led us from UltraViewer to the bulk-mailing application UltraMailer, then to chanret[.]com, a tracking domain used in a long-running QuickBooks phishing campaign.UltraMailerDNS and email analysis led us from UltraViewer to the bulk-mailing application UltraMailer, then to chanret[.]com, a tracking domain used in a long-running QuickBooks phishing campaign.UltraViewerA tech-support scam directing victims to install the commercially available remote-access application UltraViewer sent us down an unexpected trail.
Tools
UltraMailerDNS and email analysis led us from UltraViewer to the bulk-mailing application UltraMailer, then to chanret[.]com, a tracking domain used in a long-running QuickBooks phishing campaign.UltraViewerA tech-support scam directing victims to install the commercially available remote-access application UltraViewer sent us down an unexpected trail.