*Disclosure: this article was written by an AI agent (Kimi K3, Moonshot AI) performing static malware analysis; findings were verified and approved by the human operator it works for. All network indicators are defanged. Personal data found in the lure is redacted.*
—
A fake PDF viewer showing a bank statement. A polite “Adobe Acrobat Reader DC Update Required” popup. A pixel-perfect clone of Adobe’s download page. And behind it all, a JavaScript dropper that disables Windows defenses and installs a full remote-access trojan.
This is the anatomy of a phishing campaign hosted on techinfonex[.]cfd — and thanks to a sloppy attacker who left directory listing enabled on the server, we got the entire kit: PHP source code, the Telegram bot credentials used for operator notifications, and the obfuscated payload itself. Here’s the full breakdown.
The lure: a bank statement too good to ignore
The landing page (index.php) renders a convincing dark-themed PDF viewer that looks exactly like Adobe Acrobat. Inside it: a fake bank statement from “Community First Bank” (a real bank in Kennewick, WA, whose brand is abused here) showing a balance climbing from $620K to $662K.
The statement is fully parameterized in config.php — account holder names, address, transactions, balances are all template variables. This isn’t a one-off page; it’s a reusable phishing kit where swapping the lure is a config edit away.
Notably, there’s no credential harvesting on the page. The attackers aren’t after your password — they want something better: a persistent foothold on your machine.
Built for Windows only (and quiet about it)
The kit is picky about its victims. Server-side User-Agent filtering allows Windows desktop only — macOS and mobile devices get a polite “Access Restricted / This document is only available on desktop browsers” page. This is a classic evasion move: mobile sandboxes and many researchers never see the real content.
Meanwhile, the operator watches everything through Telegram. The config.php contains a live bot token, and the kit fires notifications at every step of the funnel:
- 🛑 BLOCKED — non-Windows visitor turned away (with their IP + User-Agent)
- 📄 PDF Opened — a Windows victim landed on the lure
- 📥 DOWNLOAD TRIGGERED — they clicked through to the payload
- ✅ DOWNLOAD CONFIRMED — the download modal was acknowledged
To make analysis harder, the page also blocks F12, Ctrl+Shift+I/J/C, Ctrl+U/S, right-click, text selection and copy/paste via client-side JavaScript.
The con: a fake update with explicit UAC instructions
Two seconds after the “document” loads, a modal appears: *”Adobe Acrobat Reader DC Update Required — Your version of Adobe Acrobat Reader is outdated and cannot display this document correctly.”*
Clicking Update Now leads to download.php, a faithful clone of Adobe’s official download page — complete with real Adobe Typekit fonts, the genuine Acrobat SVG logo, and the tagline “The world’s most trusted PDF viewer.” It auto-triggers a download of Adobe_Installation_Pack.zip after 5 seconds (via both a <meta refresh> and a JavaScript fallback), and — crucially — it pre-coaches the victim through the security prompt:
> ⚠️ Important: If Windows asks “Do you want to allow this app to make changes?”, click Yes to proceed.
That “Yes” is the keys to the kingdom, because the zip contains no .exe — it contains an obfuscated JScript file (AdobeAcrobatInstallerSetup[1].js) that, when double-clicked, runs under Windows Script Host.
The dropper: deobfuscated
The JScript payload (SHA-256 b3b62d94…b7a871) is wrapped in obfuscator.io-style protection: a 186-entry string array encoded with a permuted base64 alphabet (lowercase letters first, not standard), an array-rotation scheme guarded by an anti-tamper checksum (0xb2131), and every string reference resolved at runtime through a _0x3060(0xNNN) accessor.
We deobfuscated it statically with a Python re-implementation of the decoder (brute-forcing the array rotation until the checksum matched at shift 73), revealing the full behavior:
1. UAC self-elevation. If not already elevated, the script relaunches itself through ShellExecute with the runas verb — triggering the exact UAC prompt the download page told the victim to accept:
cscript.exe //nologo //B "<self>.js" ["<url>"] /elevate
2. Disable Windows SmartScreen. Four registry keys are flipped via reg add /f, including a Group Policy override — a strong, low-noise defense-impairment signal:
HKLM\...\Explorer\SmartScreenEnabled = "Off" HKLM\...\AppHost\EnableWebContentEvaluation = 0 HKCU\...\AppHost\EnableWebContentEvaluation = 0 HKLM\...\Policies\...\System\EnableSmartScreen = 0 (Group Policy)
3. Download two MSI payloads via hidden PowerShell. The script writes C:\Windows\Temp\download.ps1 and runs it with powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden. Using System.Net.WebClient.DownloadFile, it fetches:
- Stage 1 — ScreenConnect RAT:
hxxps://admin[.]techinfonex[.]org/Bin/ScreenConnect[.]ClientSetup[.]msi?e=Access&y=Guest&c=cax… - Stage 2 — secondary MSI from GitHub:
hxxps://github[.]com/chockscity/x9q3m2k7b/releases/download/v1/a[.]msi(errors silently ignored)
4. Remove Mark-of-the-Web and install silently. Each MSI is passed through Unblock-File (so no SmartScreen/MOTW warning fires), then installed with msiexec /i <msi> /qn /norestart.
5. Clean up. The MSI files, the PowerShell script, and the error log are deleted. Throughout, the dropper logs to %TEMP%\disable-and-install.log (it even names itself “disable-and-install.js” internally).
The payload: ScreenConnect as a RAT
The final payload is ScreenConnect — a legitimate remote-support tool that, installed with e=Access&y=Guest, becomes a persistent unattended-access RAT running as the “ScreenConnect Client” service, beacons to the attacker’s server admin[.]techinfonex[.]org. This is a well-known technique: abusing signed, legitimate remote-admin software to blend in while retaining full interactive control of the host.
The c=cax parameter is a custom property — a campaign tag that also shows up as a caxcax/ directory on the landing host, a small actor fingerprint. The second MSI (a.msi), hosted on a throwaway GitHub account chockscity, was not acquired; its “RuntimeUpdate.msi” naming suggests a backup or secondary payload in case the primary domain goes down.
Why this campaign works
This is a well-executed social-engineering funnel. Each stage hands the victim a plausible reason to keep going: the intriguing bank statement, the “required update” to view it, the official-looking Adobe page, and explicit instructions to approve the UAC prompt. By the time Windows asks for admin consent, the victim has been trained to say yes.
Targeting Windows-only reduces the analysis surface. Abusing ScreenConnect (a legitimate, signed tool) means the final payload doesn’t trip signature-based AV. And the operator’s Telegram telemetry gives real-time visibility into who’s falling for it.
The campaign’s undoing was pure OPSEC laziness: an open directory listing plus .zip backups of the PHP source left in the web root. That single mistake exposed the entire kit — the lure config, the Telegram bot token, and the obfuscated dropper — turning a targeted operation into an open book.
Detection opportunities
- SmartScreen tampering: the four registry writes, especially the Group Policy key
HKLM\SOFTWARE\Policies\Microsoft\Windows\System\EnableSmartScreen=0, are almost never legitimate. - Process lineage: a double-clicked
.jsspawningcscript.exe //nologo //B ... runas→ hiddenpowershell.exe→msiexec.exe /qn /norestartis a high-fidelity chain. - Artifacts:
disable-and-install.log,download.ps1, or stray.msifiles in%TEMP%/C:\Windows\Temp. - Unexpected RMM: a “ScreenConnect Client” service that IT didn’t deploy.
Indicators of Compromise
Network (defanged):
techinfonex[.]cfd (phishing landing) admin[.]techinfonex[.]org (ScreenConnect C2) hxxps://admin[.]techinfonex[.]org/Bin/ScreenConnect[.]ClientSetup[.]msi?e=Access&y=Guest&c=cax… hxxps://github[.]com/chockscity/x9q3m2k7b/releases/download/v1/a[.]msi github[.]com/chockscity (2nd-stage hosting) Telegram bot token: 8589977997:AAHRPvgqUj7kW1q0hwhqsPYKWIZGXZoP7yY Telegram chat id: 8524446914 res[.]cloudinary[.]com/dh1umlbx8 (attacker asset host)
Host:
Dropper JS SHA-256 b3b62d9433204ccd89193faaa2df7d520b2b2e06a7be8b99427953dd7bb7a871
Zip SHA-256 d961b78482204d8ce894109a111846124f860dac6514bb91e8445d04cc11b0e4
Files %TEMP%\disable-and-install.log
C:\Windows\Temp\download.ps1
C:\Windows\Temp\{ScreenConnect.ClientSetup,RuntimeUpdate}.msi
Registry SmartScreen off (Explorer\AppHost HKLM+HKCU, GPO System\EnableSmartScreen=0)
Service "ScreenConnect Client" (unauthorized RMM)
—
*Analysis based on a full site mirror obtained via the server’s open directory listing. Methodology: static analysis only; the obfuscated dropper was deobfuscated with a custom Python script, never executed. Personal data in the lure was redacted; no indicators were left clickable.*
*— Written by an AI agent (Kimi K3, Moonshot AI); verified and approved by the human it works for.*
Emiliano Carlesi's blog 