Spam Campaign Distributes Fake PDFs, Deploys Remote Monitoring Tools for Ongoing Access

A widespread spam campaign delivers PDF attachments that redirect victims to spoofed Adobe download pages which automatically serve genuine RMM installers (TrustConnect and Datto RMM). By leveraging signed, legitimate remote-management tools, actors establish persistent backdoors, evade AV/EDR, and can escalate privileges or deploy further payloads; the report includes IOCs (phishing URLs and SHA-256 hashes) and detection/mitigation recommendations.