Fake Adobe Reader Download Delivers ScreenConnect Through Stealthy In-Memory Loader

Zscaler ThreatLabz identified a stealthy campaign that spoofs an Adobe Acrobat Reader download to deliver an obfuscated VBScript (Acrobat_Reader_V112_6971.vbs) which launches a multi-stage, largely in-memory loader via PowerShell. The loader compiles and runs a .NET assembly from memory, performs PEB-based process masquerading and a COM-based UAC bypass to gain elevation, then downloads and silently installs ConnectWise ScreenConnect (ScreenConnect.ClientSetup.msi) to provide attackers remote access; the report includes URLs, filenames, techniques used, and mitigation recommendations.