Huntress Exposes Phishing Attacks Leveraging Fake Browser Windows and Rogue RMM Tools
Researchers from Huntress have unveiled a sophisticated phishing operation that intricately combines deceitful fake browser windows with authentic remote management software, allowing attackers to maintain persistent access to their victims’ devices. These alarming discoveries were made during investigations into two distinct incidents that occurred in August.
Methodology of the Attacks
The first step in both attacks involved the distribution of phishing emails that lured unsuspecting victims to websites controlled by the attackers. Utilizing a browser-in-the-browser (BiTB) technique, the culprits expertly crafted what seemed to be a legitimate Adobe webpage. Victims were subsequently misled into downloading malicious software disguised as an essential update for Adobe Reader.
The attackers took an unconventional route by opting not to deploy traditional malware. Instead, they installed unauthorized versions of ScreenConnect, a reputable remote monitoring and management (RMM) software tool, which granted them ongoing remote access to compromised devices.
Understanding Browser-in-the-Browser (BiTB) Attacks
BiTB attacks employ HTML, CSS, and JavaScript to create a fake browser window within a legitimate webpage. This window convincingly replicates typical browser features, such as an address bar, security padlock, and URLs that appear legitimate. Such sophistication complicates the conventional wisdom of checking web addresses, making it increasingly difficult for users to identify phishing attempts.
Detailed Account of the First Attack
On August 25, the first incident was recorded when a victim clicked on a link embedded in a phishing email, redirecting them to a counterfeit CAPTCHA page. Once there, the victim was presented with blurred documents and prompted to download the purported Adobe PDF Reader to access the materials.
This manipulated browser window successfully presented a fake URL that mirrored Adobe’s genuine address, get.adobe.com. However, unbeknownst to the victim, the supposed Reader installer was actually a version of ScreenConnect. Upon installation, the attackers proceeded to deploy two rogue ScreenConnect clients, effectively creating redundant pathways for continued access. They also executed a tool named HideCursor.exe, designed specifically to evade detection by concealing activities on the victim’s screen. Fortunately, Huntress intervened before the attackers could advance their objectives further.
The Follow-Up Attack
The security team at Huntress identified a second phishing incident on August 31 that followed a similar strategy, once again using the seductive bait of the Adobe Reader lure. This time, however, the victim interacted with a malicious link that arrived via AT&T Office@Hand, a legitimate communications platform powered by RingCentral. As in the previous incident, the attackers disguised ScreenConnect as an Adobe Reader update, leading to the installation of two unauthorized clients.
In this second session, the attackers executed another evasion binary, HideUL.exe. Although Microsoft Defender successfully detected part of the malicious activity, the rogue ScreenConnect client completed its installation before Huntress could terminate the operation.
The Rise of RMM Abuse
The insights gleaned from these attacks highlight a worrisome trend: the exploitation of legitimate tools by threat actors. Remote monitoring and management software abuse is increasingly becoming a significant challenge in the cybersecurity landscape. According to Huntress’s 2026 Cyber Threat Report, incidents of RMM abuse surged by a staggering 277% year-over-year, appearing in nearly 25% of the company’s examined cases.
Recommendations for Organizations
To combat these sophisticated phishing schemes, Huntress has put forth several recommendations for organizations. Firstly, companies should restrict who has the authority to install remote management tools. Maintaining a curated inventory of approved RMM software and closely monitoring for unauthorized ScreenConnect clients can also mitigate risks. Furthermore, employees are advised to be vigilant about unexpected software update prompts or file-viewing requests, especially when they seem to originate from a legitimate-looking web address.
In light of the evolving tactics employed by cybercriminals, vigilance and proactive measures are essential in safeguarding digital environments. For those interested in a deeper exploration of Huntress’s research, further details can be found in their full report.
Conclusion
The revelation of these phishing attacks underscores the complexities and challenges that organizations face in an era where cyber threats evolve continuously. The successful blending of familiar phishing techniques with trusted software not only heightens the stakes for cybersecurity professionals but also stresses the importance of education and prevention strategies among all users.