Huntress researchers have uncovered two phishing attacks that combined convincing fake browser windows with legitimate remote management software to establish persistent access to victims’ devices.

Both incidents, observed in August, began with phishing messages directing victims to attacker-controlled websites. The attackers then used a browser-in-the-browser (BiTB) technique to create what appeared to be a legitimate Adobe webpage, before convincing victims to download malicious software disguised as an Adobe Reader update.

Rather than deploying conventional malware, the attackers installed rogue instances of ScreenConnect, legitimate remote monitoring and management (RMM) software, giving them continued remote access to compromised endpoints.

Fake browser makes phishing harder to spot

BiTB attacks create a fake browser window inside a webpage using HTML, CSS and JavaScript. The window can replicate familiar features including an address bar, padlock and legitimate-looking URL, making traditional advice such as checking the web address less effective.

In the first attack, detected on 25 August, a victim clicked a link in a phishing email and was taken to a fake CAPTCHA page. They were subsequently presented with blurred documents and told they needed to download Adobe PDF Reader to view them.

The fake browser page appeared to show Adobe’s legitimate get.adobe.com address. However, the supposed Reader installer was actually ScreenConnect.

Once installed, the attackers deployed two rogue ScreenConnect clients, providing redundant routes for maintaining access. They then executed HideCursor.exe, a defence-evasion tool designed to conceal on-screen activity. Huntress intervened before the attack could progress further.

Second attack follows same playbook

Huntress identified another incident on 31 August involving the same Adobe Reader lure.

This time, the victim interacted with a malicious link delivered through AT&T Office@Hand, a legitimate communications service powered by RingCentral. The attackers again disguised ScreenConnect as an Adobe Reader update and installed two unauthorised instances.

The second ScreenConnect session was used to execute another defence-evasion binary, HideUL.exe. Microsoft Defender detected part of the activity, but the rogue ScreenConnect client still completed its installation before Huntress shut down the attack.

Legitimate tools remain attractive to attackers

The attacks demonstrate how threat actors can combine familiar phishing techniques with trusted software to make malicious activity harder to identify.

RMM abuse is a growing problem. Huntress’ 2026 Cyber Threat Report found RMM abuse increased 277% year on year and appeared in nearly a quarter of the incidents investigated by the company.

Huntress recommends organisations restrict who can install remote management tools, maintain an approved inventory of RMM software and monitor for new or unauthorised ScreenConnect clients. Employees should also be wary of unexpected software updates or file-viewing prompts, even when a webpage appears to display a legitimate address.

Read the full research here. 

The post Huntress Uncovers Phishing Attacks Using Fake Browser Pages and Rogue RMM Tools appeared first on IT Security Guru.

Huntress will be heading to International Cyber Expo 2026, where visitors can meet the team on Stand K94 and discover how the company is helping organisations tackle increasingly complex cyber threats with fewer resources.

One of the biggest challenges Huntress is seeing is the growing attack surface. Security teams are expected to protect endpoints, identities, cloud environments and other systems, often while dealing with limited time, resources and expertise.

At the same time, attackers are no longer operating in silos. Attacks increasingly move across different parts of an organisation’s environment, leaving security teams managing multiple tools and an overwhelming number of alerts.

At International Cyber Expo, Huntress will showcase its more unified, managed approach to security. The Huntress platform combines greater visibility across the attack surface with AI technologies and human security analysts to help partners and customers detect and respond to threats.

Tackling the rise of AI-powered attacks

AI-powered cybercrime will also be a major focus for Huntress at the show.

Generative AI is making it easier for attackers to create convincing phishing emails, develop malicious code and scale their operations. Tasks that previously required significant cybersecurity expertise can now be carried out with the help of readily available AI tools.

Huntress believes AI will also play an important role in helping defenders respond. Its approach uses AI to help analysts correlate security signals, summarise investigations and work faster, while retaining human judgement and context when making critical security decisions.

Visitors can also speak with Huntress about practical ways to strengthen their security posture. These include implementing multi-factor authentication, improving security awareness training and reducing vulnerabilities across the external network perimeter.

And when preventive controls fail, Huntress stresses the importance of having a mechanism to detect and respond to attacks quickly, including access to a 24/7 SOC that can support containment and remediation.

Listen to Huntress Senior Sales Engineer Alex Hitchen discuss the biggest cybersecurity challenges facing organisations today and what Huntress will be showcasing at International Cyber Expo 2026:

You can still register for FREE to attend International Cyber Expo HERE.

The post Meet Huntress at International Cyber Expo 2026 appeared first on IT Security Guru.