New Malware-as-a-service Leveraging Adobe-themed Domain to Attack Windows Users Using .bat File

A criminal service is hiding behind a website that appears to offer Adobe Acrobat Reader. The site, acrobatreaderonline.com, is not a document service. Instead, it appears to expose an operator panel for building and managing attacks against Windows users.

The campaign uses a familiar trick: a trusted-looking document or payment theme leads a target toward a harmful download.

Earlier activity tied to the same infrastructure used a Windows batch, or .bat, file through a WebDAV remote folder, turning a PDF or boleto lure into a possible malware entry point.

Researchers at Clandestine identified the operation during an open-source review on August 23, finding a live malware-as-a-service, or MaaS, panel behind the Adobe-themed domain.

Clandestine said in a report shared with Cyber Security News (CSN) that the site was not an Adobe reader portal and should not be treated as safe.

The discovery shows how a convincing brand imitation can move from a phishing lure to a working criminal platform. It contains features for collecting victim data, managing files and preparing malware modules, lowering the barrier for operators.

New Malware-as-a-service Leveraging Adobe-themed Domain

The domain creates a serious trust problem for people searching for a PDF reader, opening document links or responding to payment messages.

Its public page uses the title “SecureWorkspace WebPanel,” while an application route identifies itself as “Kaido Panel.” Neither is a legitimate document viewer or cloud document service.

Behind the landing page, researchers found protected endpoints for a command-and-control interface and a live SignalR communication hub.

Unauthenticated requests returned a bearer-authentication challenge, showing the site is more than a static decoy. It is designed to give authorized operators access to backend functions.

Public JavaScript exposed references to a builder, file manager, authentication refresh function and a section labelled loot. The code listed modules connected with information theft, banking overlays, PIX payments and boleto lures.

That mix makes the operation relevant to Windows users and organizations processing financial documents. The documented delivery chain shows why a file extension can matter as much as a document name.

Historical sandbox records linked Kaido infrastructure to a WebDAV loader using a .bat dropper and the Windows WebClient service. Similar Windows File Explorer WebDAV abuse can open remote content in ways that appear less suspicious than a conventional download.

A batch file can run commands when a victim opens it, so it should never be assumed to be a harmless document. Users should question supposed PDF files with unusual extensions, shortcuts or download prompts.

Recent fake Adobe document campaigns have likewise used familiar sharing language to persuade recipients to run unwanted software.

Infrastructure and Defensive Actions

The domain was registered in June 2026 and uses Cloudflare-hosted infrastructure. Its nameservers match those used by kaido.sh, a related domain seen earlier.

At the time of review, only the www host resolved; several likely service names did not. A future address assigned to those names may signal a command-and-control shift.

This justifies immediate checks. Organizations should block the identified domains across DNS, web proxies and email controls, then examine logs for requests to them.

Teams should look for unexpected WebClient activity and the listed local cache artifact, which can reveal WebDAV-based delivery.

Users should download Acrobat Reader only from Adobe’s official domain, not lookalike sites or unsolicited links. Security teams should avoid logging into the panel or executing files obtained from it.

The risk fits a pattern seen in malware disguised as trusted apps, where recognizable names weaken a user’s caution. For defenders, combine domain blocking with alerts for suspicious remote-folder connections and script launches.

Preserve relevant telemetry before action, check whether artifacts appear on endpoints, and report the infrastructure to the registrar, hosting provider and national response teams.

A Windows AllaKore malware operation illustrates how PDF lures, WebDAV and batch scripts can form a multi-stage Windows compromise.

Indicators of comrpomise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post New Malware-as-a-service Leveraging Adobe-themed Domain to Attack Windows Users Using .bat File appeared first on Cyber Security News.