Fake Adobe Acrobat pages are distributing signed ScreenConnect installers configured for attacker-controlled remote access to Windows PCs.

Fake Adobe Acrobat pages distribute signed ScreenConnect installers configured for attacker-controlled remote access to Windows PCs, CloudSEK’s researchers say.

Fake Adobe Acrobat pages are distributing signed ScreenConnect installers configured for attacker-controlled remote access to Windows PCs.

Fake Adobe Acrobat pages distribute signed ScreenConnect installers configured for attacker-controlled remote access to Windows PCs, CloudSEK’s researchers say.

Fake payroll desktop apps hand attackers a route to company paychecks - Help Net Security

Fake payroll desktop apps hand attackers a route to company paychecks - Help Net Security

Fake payroll desktop apps hand attackers a route to company paychecks - Help Net Security

Fake payroll desktop apps hand attackers a route to company paychecks - Help Net Security

Cybercriminals are using fake Adobe Acrobat and document-signing pages to distribute legitimate ConnectWise ScreenConnect remote-access software, potentially giving external operators persistent access to Windows systems. A new CloudSEK investigation reveals how trusted, digitally signed software is being used with unauthorized remote-access configurations, creating risks that conventional file-signature checks alone may not detect. Key findings: Legitimate software abused: Two genuine, digitally signed ScreenConnect installers were identified with configurations pointing to separate remote-access tenants.

ConnectWise incident on October 29, 2026: We are investigating reports of ScreenConnect instances not loading. Cloud Ops team is working to identify and resolve impacted instances. Started 3:23 PM UTC, resolved ongoing (● 6m). Affected: ScreenConnect, x360Sync (x360Sync — North America).

Undercode Cybersecurity Intelligence | October 29, 2026 Introduction: When Legitimate Software Becomes a Threat Cybersecurity researchers at CloudSEK have linked a suspicious campaign involving fake document-review websites to genuine, digitally signed ScreenConnect installers configured to connect to unauthorized remote-access tenants. The operation reportedly combines deceptive web pages, visitor profiling, and Telegram-based data transmission to support a potentially malicious remote-access workflow.