Threat Actors Use Fake Adobe Reader Download To Deploy ScreenConnect

Zscaler ThreatLabz identified a sophisticated campaign that lures victims to fake Adobe Acrobat download pages which deliver an obfuscated VBScript installer; the script uses PowerShell to bypass execution policies, pulls a secondary payload from cloud storage, compiles and runs a .NET loader entirely in memory, and deploys ConnectWise ScreenConnect as a persistent, stealthy backdoor. The report highlights in-memory execution, string/method fragmentation and other anti-analysis techniques, and recommends behavioral monitoring and detection of anomalous PowerShell executions and process masquerading.