Gagan Aggarwal

CloudSEK researchers uncovered fake Adobe Acrobat and “View & Sign” pages distributing legitimate, digitally signed ConnectWise ScreenConnect installers configured for unauthorized remote access. The campaign uses Telegram bots to track visitors, profiles devices and networks, and automatically downloads remote-access clients. The findings highlight how attackers can weaponize trusted software to potentially gain persistent access to Windows systems, bypassing traditional security checks based on file signatures.

BlueKit is turning phishing into a subscription business, offering 87 ready-made kits, automated account takeover and stealthy peer-to-peer infrastructure. CloudSEK’s investigation reveals how this mature PhaaS platform helps even low-skilled criminals target banks, cloud services and global brands.