# Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence

BiTB phishing pages impersonating Adobe delivered rogue ScreenConnect installers, giving attackers persistent remote access to victim endpoints.

- Payout: Real-world hack
- Severity: high
- Program: ScreenConnect
- Analysis by: Huntress
- Disclosed: 2026-09-09
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/phishing-bitb-rmm-attacks
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-phishing-bitb-rmm-attacks
- Tags: area:web domain:web impact:integrity impact:internal-access impact:rce kind:incident platform:threat-intel sev:high tech:windows technique:chained technique:recon vuln:misconfiguration

**Target:** ScreenConnect RMM client installer / phishing landing pages
**Root cause:** Attackers render a fake browser window (address bar, padlock, favicon) inside webpage HTML/CSS/JS, showing a legitimate get.adobe.com URL, so users trust the download prompt and execute an attacker-supplied ScreenConnect installer.
**Steps:**
1. Victim clicks phishing link (e.g. `https[://]adoube[.]vu/2a8ed9baefcd`) showing a fake 'Safe access' CAPTCHA check.
2. Redirect to `adoube[.]vu/filedocacess/file.html` presenting blurred files and an Adobe PDF Reader update prompt.
3. Clicking 'View Files' renders a BiTB fake browser window showing get.adobe.com, instructing download of 'Acrobat Reader'.
4. Victim downloads and runs `ScreenConnect.ClientSetup.exe` from `hosthiifran[.]screenconnect[.]com`.
5. Installer deploys rogue ScreenConnect client `9c1aea531ba4c511` to `instance-uxh86b-relay[.]screenconnect[.]com`.
6. Client uses `cmd.exe` and `curl` to fetch and install second client `7c1d255d0efefde6` pointing at `144.172.115[.]59:8041`.
7. Both clients register as Windows services for persistence; attacker runs `HideCursor.exe` for defense evasion.
**How found:** Huntress SOC detected malicious activity tied to a suspicious rogue RMM instance on an endpoint, then traced telemetry back through the phishing chain to the BiTB pages and installer.
**Exploitation:** Phishing email -> fake CAPTCHA -> fake Adobe file page -> BiTB fake browser window -> victim executes ScreenConnect installer -> multi-stage download of two rogue ScreenConnect clients registered as services -> attacker gains persistent remote access and runs defense-evasion binaries (HideCursor.exe/HideUL.exe).
**Escalation:** Two redundant ScreenConnect clients ensure a foothold survives detection of one instance; legitimate trial relay domains and DigitalOcean Spaces hosting evade detection.
**Insight:** Rogue RMM abuse: attackers install legitimate ScreenConnect clients as services for persistence; defenders should alert on new/unapproved ScreenConnect clients, unusual relay domains, and executables launched from Downloads folders.