Beware of Phishing Emails Disguised as Transaction Receipts

AhnLab ASEC identified a phishing campaign that delivers a malicious PDF claiming a transaction receipt and prompting an Adobe Flash update; the PDF links to a hosted VBS which, when run, elevates privileges, shows a decoy receipt, and silently downloads and installs an MSI package (ScreenConnect). The installed ScreenConnect client registers the host as an Access session and connects to relay.Gamedbd.Com:8041, enabling persistent remote access and follow-on activity; the report provides specific IOCs (URLs and MD5 hashes).