Spam Campaign Distributes Fake PDFs, Installing Remote Monitoring Tools for Persistent Access

Executive Summary: Security teams have identified an active spam campaign distributing fake PDF documents (e.g., “Invoice_Details.pdf”) that prompt victims to download what appears to be Adobe but instead deploys legitimate RMM tools (ScreenConnect, Syncro, NinjaOne, SuperOps) controlled by attackers; these signed RMM agents provide persistent remote access and often bypass security controls. The report describes the infection chain, persistence tactics, and recommends restricting unapproved RMM installs, deploying EDR, staff phishing training, and network monitoring/blocking of malicious domains.