Fake Acrobat Download Uses Obfuscated Loaders to Install ScreenConnect
Summary
Zscaler ThreatLabz details a February 2026 attack using a fake Acrobat download to deliver ScreenConnect through obfuscated scripts, in-memory .NET execution, process masquerading, and a COM-based UAC bypass.
Key points
- A fraudulent Adobe impersonation page automatically downloads an obfuscated VBScript posing as an Acrobat Reader installer.
- The VBScript launches PowerShell, which downloads a file from Google Drive and compiles C# code in memory.
- The .NET loader uses reflection to load and execute an embedded assembly without writing the compiled payload to disk.
- The loader manipulates PEB process-name fields to masquerade as winhlp32.exe.
- The attack abuses auto-elevated COM objects to seek elevated privileges without prompting the victim.
- A final PowerShell stage downloads and installs ScreenConnect from a separate URL.
- ThreatLabz lists malware detections and file-hash and URL indicators of compromise.
Article Details
- Attack Vectors
- A fraudulent site impersonating Adobe offered a fake Adobe Acrobat Reader download and automatically downloaded an obfuscated VBScript loader.
- The VBScript launched PowerShell with -ExecutionPolicy Bypass; PowerShell downloaded staged files from Google Drive and compiled C# code in memory.
- The in-memory loader used .NET reflection to load and execute an embedded assembly, and modified PEB fields to masquerade as winhlp32.exe.
- The loader abused auto-elevated COM objects to obtain elevated privileges without prompting the victim.
- PowerShell downloaded a ScreenConnect installer from x0[.]at and launched it via msiexec.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 07720d8220abc066b6fdb2c187ae58f5 | Hash listed as an indicator for the malicious VBScript. |
| MD5 | 07f95ff34fb330875d80afadca3f0d5b | Hash listed for C# code containing the .NET assembly used in the attack. |
| MD5 | 3d389886e95f00fade1eea67a6c370d1 | Hash listed for the MSI installer used in the attack. |
| MD5 | 3effadb977eddd4c48c7850c8dc03b13 | Hash listed for C# code containing the .NET assembly used in the attack. |
| MD5 | a7e5dbec37c8f431d175dfd9352db59f | Hash listed for C# code containing the .NET assembly used in the attack. |
| MD5 | c02448e016b2568173de3eedadd80149 | Hash listed for an EXE associated with the attack. |
| MD5 | c36910c4c8d23ec93f6ae7d7a2496ce5 | Hash listed as an indicator for the malicious VBScript. |
| MD5 | e4b594a18fc2a6ee164a76bdea980bc0 | Hash listed as an indicator for the malicious VBScript. |
| URL | hxxps[:]//x0[.]at/qOfN[.]msi | URL used to deliver the ScreenConnect installer in the attack. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe VBScript and PowerShell stages obfuscated strings and commands; the loader also split method and type names and reconstructed strings at runtime.T1036.005 · Match Legitimate Resource Name or LocationThe loader rewrote PEB image-name fields to make its process appear as C:\Windows\winhlp32.exe.T1059.001 · PowerShellPowerShell downloaded staged files, compiled and ran the in-memory loader, and installed ScreenConnect.T1059.005 · Visual BasicThe attack began with an obfuscated VBScript loader that launched the follow-on command.T1105 · Ingress Tool TransferThe loaders downloaded staged files and the ScreenConnect installer from remote URLs.T1548.002 · Bypass User Account ControlThe loader abused Windows auto-elevated COM behavior to obtain elevated privileges without prompting the victim.T1620 · Reflective Code LoadingThe PowerShell stage compiled C# in memory, and the loader used Assembly.Load(byte[]) and reflection to execute the embedded assembly.
Vendors
AdobeIn February 2026, Zscaler ThreatLabz discovered an attack chain where attackers used a fake Adobe Acrobat Reader download to lure victims into installing ConnectWise’s ScreenConnect. While ScreenConnect is a legitimateConnectWiseattack chain where attackers used a fake Adobe Acrobat Reader download to lure victims into installing ConnectWise’s ScreenConnect. While ScreenConnect is a legitimate remote access tool, it can be leveraged for
Products
Adobe Acrobat ReaderIn February 2026, Zscaler ThreatLabz discovered an attack chain where attackers used a fake Adobe Acrobat Reader download to lure victims into installing ConnectWise’s ScreenConnect. While ScreenConnect is a legitimateMicrosoft WindowsProcess Environment Block (PEB) manipulation masquerades the loaders running Windows process, helping it blend in and avoid endpoint detection and response (EDR) alerts. PowerShellPowerShell staging/loaderScreenConnectattackers used a fake Adobe Acrobat Reader download to lure victims into installing ConnectWise’s ScreenConnect. While ScreenConnect is a legitimate remote access tool, it can be leveraged for malicious purposes.