CloudSEK: fake Adobe Acrobat and 'View & Sign Form' pages push attacker-configured ScreenConnect
CloudSEK reports fake Adobe Acrobat and "View & Sign Form" pages that download genuine ScreenConnect installers configured to connect to attacker tenants; operators are not identified.
- First reported
- Reports
- 1
Source: cloudsek.com · published
What happened
CloudSEK researchers report an Adobe Acrobat Reader-themed lure hosted at clickksy.icu (registered on 2 October 2026) that is associated with downloads of genuine, digitally signed ConnectWise ScreenConnect installers preconfigured to connect to attacker-controlled ScreenConnect Cloud tenants (named omydze and vvvzou). Adobe and ConnectWise are impersonated or abused, not involved. A related cluster of "View & Sign Form" and "Sign in to view document" pages profiled visitors, sent the details to Telegram bots and automatically downloaded ScreenConnect clients. CloudSEK says operator attribution is unresolved and no victim compromise was confirmed.
How the scam works
The installers were not trojanized: the risk comes from their configuration. According to CloudSEK they were set up for guest access and included relay details, and static analysis of the installer package showed a service that starts automatically and runs with the highest local privileges (LocalSystem). If installed, they could give an outside operator persistent, interactive access to a Windows PC, which could support data theft, exposure of user sessions, lateral movement or delivery of further tools. Because the files carry valid vendor signatures, signature checks alone do not flag them.
The "View & Sign Form" pages checked the visitor's operating system and redirected people who were not on Windows desktops, looked up the public IP address and location, sent a Telegram message with IP, ISP, device, browser, time and location, applied ISP-based filters that can suppress the download for some networks, and then automatically downloaded a tenant-specific ScreenConnect client. Non-Windows visitors were sent via motormotif.com/falscon towards a fake identity-verification page. CloudSEK lists campaign domains including clickksy.icu, prependinganalysis.site, greenandverified.site, testedinception.site, interestinghub.site, intentionallydurable.site, intentionallyevaluated.site and motormotif.com. CloudSEK could not retrieve the Adobe page itself and did not identify the messages used to send victims there.
Source
CloudSEK, "Fake View & Sign and Adobe Acrobat Lures Deliver Attacker-Configured ScreenConnect Clients", 29 October 2026.
Red flags
- A page styled as Adobe Acrobat or "View & Sign Form" that downloads an installer automatically.
- A remote-access tool (ScreenConnect) installed from a document-review page you did not expect.
- A web address on an unfamiliar domain, such as clickksy.icu or a random .site domain.
- An unexpected remote-support service appearing on a PC after opening a "document".
- Recruitment or document-review pretexts such as "Candidate Information".
If you were targeted
- 1Do not run installers you did not expect from a document-signing or Acrobat page.
- 2If you ran one, disconnect the PC, uninstall ScreenConnect, and have IT check for unauthorised services and tenants.
- 3Change passwords and review account sessions from a clean device.
- 4IT teams should look for unexpected ScreenConnect services and unapproved tenant configurations, not just file hashes.
- 5Block the campaign domains listed above and report suspicious pages to your security team.