Hackers Disguise Remote Access Tools as Zoom and PDF Installers to Take Over PCs

Hackers are using familiar Zoom setup files and PDF reader downloads to place remote-control software on business computers. The campaign turns ordinary workplace prompts into a path for outsiders to take over a device.

The phishing emails use meeting invitations, document requests, software updates, RSVP cards, job offers and delivery notices. Victims who follow the links reach pages that imitate document portals, Adobe downloads, Zoom installation pages, or collaboration services.

Microsoft analysts identified the activity in July 2026 across organizations in several industries. The operation delivers a real, digitally signed MSP360 Remote Monitoring and Management installer, but disguises it with names designed to look safe.

Microsoft said in a report shared with Cyber Security News (CSN) that it has not tied the campaign to a named group. The finding shows why trusted administration tools can be just as dangerous as traditional malware when an attacker controls their installation.

Hackers Disguise Remote Access Tools as Zoom and PDF Installers

The initial file is MSP360 RMM version 2.5.0.67, presented as a meeting app, PDF utility, invitation, or business document. The disguises exploit the same misplaced trust as signed workplace application lures that abuse familiar names to lower suspicion.

After a victim runs the file and approves the Windows administrator prompt, it installs MSP360 services and adds automatic startup entries. It also creates a firewall rule allowing inbound UDP traffic to the RMM agent on port 48678, giving the software the access it needs to communicate.

The attackers did not exploit a flaw in the remote-control programs. Instead, they used legitimate tools as intended, except the remote session belonged to them. That distinction can make the intrusion blend into normal technical-support activity and complicate quick detection.

Not every attempt succeeded. Where users denied or abandoned the administrator approval prompt, installation stopped before the remote-management components were fully deployed.

Microsoft also saw separate July activity using another legitimate deployment agent to install ScreenConnect, showing that the approach was not limited to MSP360.

The delivery infrastructure changes frequently. Links have sent users to attacker-controlled sites, compromised websites, and cloud-hosted locations on Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase.

This rotating approach echoes weaponized PDF RMM attacks, where a convincing document is only the first step toward a remote-access installation.

Second Channel Extends Control

Once MSP360 is active, its agent launches PowerShell to download an installation package and silently install a ConnectWise ScreenConnect client. That creates a second independent route into the computer, so removing one remote tool may not immediately cut off the intruder.

The ScreenConnect service then transfers and runs follow-on utilities from temporary folders in the user’s Documents or OneDrive Documents directory.

Researchers observed tools associated with password theft, browser-data collection, hiding windows or cursors, and launching further files, raising the risk of account compromise and wider network access.

This layered setup gives operators persistence, file transfer capability, and remote command execution while using software many IT teams recognize.

It reflects the same operational problem seen in the SMOKE#SCREEN remote-control campaign, where fake updates turn approved-style support software into an attacker foothold.

Organizations should maintain an inventory of approved remote-management applications and block unapproved instances, including by publisher certificate where appropriate.

They should require multi-factor authentication for sanctioned tools, keep cloud-based endpoint protection enabled, and investigate any unexpected RMM installation before it becomes a durable connection.

Security teams should also hunt for the listed installer hash, new MSP360 or ScreenConnect services, PowerShell started by the remote agent, and silent Windows Installer activity.

If an unauthorized deployment is found, passwords for accounts used to install the services should be reset, with deeper investigation when system-level credentials were involved.

Microsoft also recommends blocking or auditing process creation through PsExec and Windows Management Instrumentation, while checking for compatibility problems on some servers.

These controls target ways attackers can move between systems after gaining their first foothold. Email filters reduce chances that users reach deceptive download pages.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Hackers Disguise Remote Access Tools as Zoom and PDF Installers to Take Over PCs appeared first on Cyber Security News.