Investigation Links UltraViewer and UltraMailer Abuse to QuickBooks Phishing and Trojanized Installers
Summary
Researchers traced a QuickBooks phishing campaign using more than 350 lookalike domains and UltraMailer tracking to trojanized UltraMailer and UltraViewer installers carrying njRAT and DarkKometa. They found no evidence the software developers participated.
Key points
- The investigated campaign used more than 350 QuickBooks-lookalike domains and chanret[.]com tracking pixels that recorded email opens and encoded recipients’ addresses.
- Researchers found that the campaign briefly switched to Mail250 infrastructure; Mail250 suspended the reported account, and the observed campaign stopped before later returning to chanret[.]com.
- UltraMailer documentation describes changing tracking domains when they become blocklisted, and the article reports the software was promoted for spamming on criminal forums.
- A trojanized UltraMailer installer contained an njRAT payload; 45 of 75 VirusTotal vendors detected it as malicious at the time of analysis.
- A trojanized UltraViewer installer was attributed to Win32.Comet.A, also known as DarkKometa, and installed as Synaptics.exe under C:\ProgramData\Synaptics.
- The researchers found no evidence that UltraViewer or UltraMailer developers participated in the scams or malware distribution; they also could not independently corroborate claims that a signing certificate’s private key was stolen.
Article Details
- Attack Vectors
- Phishing emails impersonating QuickBooks support direct recipients to call scammers attempting to steal QuickBooks credentials.
- Scammers use UltraViewer in tech-support scams to obtain remote access to victims’ computers.
- Trojanized UltraMailer and UltraViewer installers contain malware; one UltraMailer sample carries njRAT, and a trojanized UltraViewer sample was attributed to Win32.Comet.A, also known as DarkKometa.
- Defensive Notes
- Organizations without a business need for UltraViewer should consider restricting access to prevent unauthorized access.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | qbcares[.]com | QuickBooks-lookalike domain identified as an example associated with the phishing campaign. |
| HOSTNAME | smtracking[.]healthclub951[.]swp23[.]com | CNAME destination used by the campaign’s smtracking[.]qbcares[.]com tracker. |
| HOSTNAME | smtracking[.]qbcares[.]com | Tracker hostname used by the campaign during its August 2026 infrastructure change. |
| HOSTNAME | track[.]chanret[.]com | Tracking-pixel hostname used by the QuickBooks phishing campaign to record message opens and identify recipients. |
| SHA256 | 28f046d9f985e58cbc8b245b54d4179feacecc12f41e2f6594306867ce3e8727 | Hash of a trojanized UltraViewer installer attributed to the Win32.Comet.A family. |
| SHA256 | 9e1a679ca45a149d2bd681cbb8ec3b1cc3d271fad51b092a3db5e5642eb6676b | Hash of a trojanized UltraMailer installer containing an embedded njRAT payload. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationA trojanized UltraViewer sample installs as C:\ProgramData\Synaptics\Synaptics.exe, impersonating the Synaptics touchpad driver.T1219 · Remote Access ToolsScammers use the legitimate remote-access application UltraViewer to gain access to victims’ computers in tech-support scams.T1566 · PhishingThe campaign sends phishing emails impersonating QuickBooks support and directs recipients to call scammers.
Threat Actors
Malware
njRATOne malicious UltraMailer installer carried njRAT, potentially infecting people who downloaded this illegitimate version of the mailing software with a remote access trojan.Win32.Comet.Ato VirusTotal on September 4, 2026, detected as malicious by 60 of 76 vendors and attributed to the Win32.Comet.A family, also known as DarkKometa.
Vendors
Products
QuickBooksDNS and email analysis led us from UltraViewer to the bulk-mailing application UltraMailer, then to chanret[.]com, a tracking domain used in a long-running QuickBooks phishing campaign.UltraMailerDNS and email analysis led us from UltraViewer to the bulk-mailing application UltraMailer, then to chanret[.]com, a tracking domain used in a long-running QuickBooks phishing campaign.UltraViewerA tech-support scam directing victims to install the commercially available remote-access application UltraViewer sent us down an unexpected trail.