Gagan Aggarwal

CloudSEK researchers uncovered fake Adobe Acrobat and “View & Sign” pages distributing legitimate, digitally signed ConnectWise ScreenConnect installers configured for unauthorized remote access. The campaign uses Telegram bots to track visitors, profiles devices and networks, and automatically downloads remote-access clients. The findings highlight how attackers can weaponize trusted software to potentially gain persistent access to Windows systems, bypassing traditional security checks based on file signatures.

O BlueKit está a transformar o phishing num negócio de subscrição, oferecendo 87 kits prontos a usar, tomada de controlo de contas automatizada e uma infraestrutura peer-to-peer furtiva. A investigação da CloudSEK revela como esta plataforma PhaaS madura ajuda até criminosos com pouca experiência a visar bancos, serviços na nuvem e marcas globais.