Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence

What it is

Two Huntress SOC incidents (August 25 and 31, 2025) using browser-in-the-browser (BiTB) phishing that spoofs a legitimate-looking get.adobe.com URL to trick users into installing rogue ScreenConnect (RMM) clients for persistent remote access. The summary covers the chain; below are the concrete IOCs, delivery channels, and detection guidance the summary omits.

How it works

Both incidents converge on the same BiTB Adobe lure but arrive via different channels. Notably, in Incident 2, Microsoft Defender flagged the second-stage patch.msi as Trojan:Win32/Commando.A!ml but remediated without blocking execution — the client still completed setup. The two-RMM design is deliberate: if one instance is caught, the other foothold survives.

flowchart TD
  A[Phishing message] --> B{Delivery channel}
  B -->|Incident 1: Gmail| C[Fake CAPTCHA adoube.vu]
  B -->|Incident 2: AT&T Office@Hand / RingCentral| D[selectstructure.com.au adobedocument.html]
  C --> E[BiTB fake get.adobe.com page]
  D --> E
  E --> F[Rogue ScreenConnect installer]
  F --> G[Client 1 - service persistence]
  G -->|cmd.exe + curl| H[Client 2 - service persistence]
  H --> I[HideCursor.exe / HideUL.exe defense evasion]

Preconditions / Affected

User must execute the disguised MSI/EXE from Downloads. Attackers abused a legitimate ScreenConnect Trial Relay domain to blend in. Windows endpoints where users can install RMM software.

What to do

Page's stated controls and IOCs to monitor:

• Restrict who can install RMM tools; maintain an approved RMM inventory; alert on new/unapproved ScreenConnect clients, unusual relay connections, and executables launched from user Downloads folders.
• Monitor for HideCursor.exe and HideUL.exe (found under ...\Documents\ScreenConnect\Temp\).

Incident 1 IOCs:

• Redirect/lure: adoube[.]vu/2a8ed9baefcd, adoube[.]vu/filedocacess/file.html
• Installer host: hosthiifran[.]screenconnect[.]com
• ScreenConnect Client IDs: 9c1aea531ba4c511 (relay instance-uxh86b-relay[.]screenconnect[.]com), 7c1d255d0efefde6 (C2 IP 144.172.115[.]59)

Incident 2 IOCs:

• Lure: selectstructure[.]com[.]au/freedom/adobedocument.html
• Installer AdbRdBkUpsStUp.msi from victory[.]mkc1[.]digitaloceanspaces[.]com
• Client d751818fd46e5ca9 (relay relay[.]goldenmelon[.]us); fetches patch.msi from wir[.]consultingics[.]com
• Client c19e38a20f1ba492 from scx[.]illuminantgroup[.]net (relay relay[.]illuminantgroup[.]net)

Caveats

Huntress lacked the original phishing lures (inferred from telemetry). AT&T Office@Hand was the delivery channel in Incident 2, not necessarily the impersonated brand. Defender detection alone did not stop the intrusion.