Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence
Phishing emails with browser-in-the-browser fake Adobe pages trick users into installing rogue ScreenConnect clients granting persistent remote access.
Huntress SOC investigated two August incidents where phishing links led to fake CAPTCHA checks and Adobe PDF Reader lures rendered as browser-in-the-browser (BiTB) pages spoofing legitimate domains like get.adobe.com. Victims downloaded what they believed was Acrobat Reader but actually installed ScreenConnect.ClientSetup.exe from attacker infrastructure, yielding two rogue ScreenConnect clients with service-based persistence. The attacker used cmd.exe and curl to stage a second client connecting to 144.172.115.59, leveraged a ScreenConnect Trial Relay domain for stealth, and ran HideCursor.exe as a defense-evasion binary. Incident 2 arrived via AT&T Office@Hand (RingCentral), with both chains stopped before broader impact.
- BiTB fake windows with address bars spoof legitimate Adobe subdomains, bypassing URL-checking habits.
- First rogue client used the Trial Relay domain to appear legitimate; second connected to 144.172.115.59.
- Fake 'safe access' CAPTCHA checks preceded the blurred-files Adobe Reader lure.
- HideCursor.exe defense-evasion binary hid on-screen activity during hands-on access.
- ATT&CK
- T1566.002 Spearphishing LinkT1219 Remote Access SoftwareT1059.003 Windows Command ShellT1105 Ingress Tool TransferT1543.003 Windows Service
- Vendors
- HuntressAdobeScreenConnect
- Products
- ScreenConnect
- Organizations
- RingCentral
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | adoube.vu | email, which took them to a fake CAPTCHA lure (at https[://]adoube[.]vu/2a8ed9baefcd ). This phishing landing page displayed a fa |
| domain | hosthiifran.screenconnect.com | was downloaded from the attacker-controlled infrastructure, hosthiifran[.]screenconnect[.]com . When the target opened their Downloads folder and exe |
| domain | instance-uxh86b-relay.screenconnect.com | Client ( 9c1aea531ba4c511 ) configured to communicate with instance-uxh86b-relay[.]screenconnect[.]com . The attacker used a legitimate ScreenConnect Trial Re |
| domain | relay.goldenmelon.us | client ( d751818fd46e5ca9 ), configured to communicate with relay[.]goldenmelon[.]us . That client (again) used the native Windows command s |
| domain | relay.illuminantgroup.net | lluminantgroup[.]net and was configured to communicate with relay[.]illuminantgroup[.]net . Both ScreenConnect clients were registered as Windows |
| domain | scx.illuminantgroup.net | nConnect Client ( c19e38a20f1ba492 ), which downloaded from scx[.]illuminantgroup[.]net and was configured to communicate with relay[.]illumina |
| domain | selectstructure.com.au | ed the malicious link in the message, which brought them to selectstructure[.]com[.]au/freedom/adobedocument.html . This domain uses the same |
| domain | victory.mkc1.digitaloceanspaces.com | eader update ( AdbRdBkUpsStUp.msi ) and was downloaded from victory[.]mkc1[.]digitaloceanspaces[.]com . Once it was executed, the installer again led to th |
| domain | wir.consultingics.com | d ScreenConnect client payload ( patch.msi ) from hxxps[://]wir[.]consultingics[.]com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&c=GO |
| ipv4 | 144.172.115.59 | de6 ) configured to communicate with attacker-controlled IP 144.172.115[.]59 . Both clients established service-based persistence for |
| sha256 | 41d2097e8ac636a478aa011e12128c03b3b9bb3c8efca43d3c4f214ac8b1f07b | ( 7c1d255d0efefde6 ) ScreenConnect.ClientSetup.exe SHA256: 41d2097e8ac636a478aa011e12128c03b3b9bb3c8efca43d3c4f214ac8b1f07b Initial payload: rogue ScreenConnect installer HideCursor.e |
| sha256 | 9f5910d69a4fbc56ff1854e7e0df3199fbfddd7fe6b374f7d816fa6ae70ef991 | sion binary ScreenConnect Client (9c1aea531ba4c511) SHA256: 9f5910d69a4fbc56ff1854e7e0df3199fbfddd7fe6b374f7d816fa6ae70ef991 Rogue RMM: initial ScreenConnect instance ScreenConnect Cli |
| sha256 | f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35 | ct instance ScreenConnect Client (7c1d255d0efefde6) SHA256: f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35 Rogue RMM: secondary rogue ScreenConnect instance Incident |
| sha256 | fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2 | yload: rogue ScreenConnect installer HideCursor.exe SHA256: fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2 Defense evasion binary ScreenConnect Client (9c1aea531ba4c5 |
From the original article
7 min read at huntress.comSee how a browser-in-the-browser phishing attack led to rogue ScreenConnect persistence and evasion tactics Huntress caught in the act.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.