Browser-in-the-Browser Phishing Campaign Abuses ScreenConnect RMM to Gain Remote Access
Browser-in-the-Browser Phishing Campaign Abuses (TL-2026-2453) is a high-severity phishing campaign, first published 2026-09-09. It has no confirmed attribution, affects ConnectWise ScreenConnect, maps to 11 MITRE ATT&CK techniques (T1036.005, T1059.003, T1090.002), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-2453
- Threat ID
- TL-2026-2453
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-09-09
- Last reviewed
- 2026-09-09
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in Browser-in-the-Browser Phishing Campaign Abuses
Malware and tooling: Trojan:Win32/Commando.A!ml, ConnectWise ScreenConnect, ScreenConnect
Huntress documented two related August 2026 phishing incidents that used Browser-in-the-Browser (BiTB) fake windows spoofing get.adobe.com to trick victims into installing rogue ConnectWise ScreenConnect clients, then ran HideCursor.exe/HideUL.exe defense-evasion binaries to hide attacker activity on screen.
How Browser-in-the-Browser Phishing Campaign Abuses works
On 2026-08-25 and 2026-08-31, Huntress investigated two related but independently-executed incidents that combined phishing, Browser-in-the-Browser (BiTB) UI spoofing, and abuse of legitimate ConnectWise ScreenConnect remote-monitoring-and-management (RMM) software to establish persistent remote access.
In Incident 1, a victim received a phishing email in Gmail containing a link to a fake 'Safe access browser check' CAPTCHA page at adoube[.]vu (a domain that visually typosquats 'adobe'). The page led to a second lure at adoube[.]vu/filedocacess/file.html displaying a blurred document and prompting the victim to 'download updated Adobe PDF Reader to view the files.' Clicking through rendered a Browser-in-the-Browser (BiTB) window entirely within the webpage's HTML/CSS/JavaScript, spoofing the legitimate get.adobe.com address bar, padlock, and URL to make the fake download prompt appear trustworthy. The victim executed the resulting installer, ScreenConnect.ClientSetup.exe (SHA256 41d2097e8ac636a478aa011e12128c03b3b9bb3c8efca43d3c4f214ac8b1f07b), served from a ScreenConnect trial-relay subdomain (hosthiifran.screenconnect.com) rather than an organization-approved instance. This installed a first rogue ScreenConnect client (instance ID 9c1aea531ba4c511, SHA256 9f5910d69a4fbc56ff1854e7e0df3199fbfddd7fe6b374f7d816fa6ae70ef991) as a Windows service, relaying through instance-uxh86b-relay.screenconnect.com. From that session, the attacker used cmd.exe with curl to pull down and install a second rogue ScreenConnect client (instance ID 7c1d255d0efefde6, SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35), which communicated with a dedicated C2 endpoint at 144.172.115[.]59:8041. The attacker then executed HideCursor.exe (SHA256 fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2) from C:\Users\REDACTED\Documents\ScreenConnect\Temp\ to suppress visible cursor movement and conceal hands-on-keyboard activity from the logged-in user.
Incident 2 followed the same tradecraft template a week later via a different initial-access vector: a phishing message delivered through AT&T Office@Hand (a RingCentral-based unified-communications product) linked to a fake PDF-viewer page at selectstructure[.]com[.]au/freedom/adobedocument.html. The BiTB flow again spoofed an Adobe download prompt, leading the victim to run AdbRdBkUpsStUp.msi, staged on a DigitalOcean Spaces bucket (victory.mkc1.digitaloceanspaces.com). This installed a first rogue ScreenConnect client (instance ID d751818fd46e5ca9) as a Windows service relaying through relay.goldenmelon.us. A second rogue client, delivered as patch.msi (instance ID c19e38a20f1ba492) from wir.consultingics.com, communicated with scx.illuminantgroup.net via relay.illuminantgroup.net and was flagged by Microsoft Defender as Trojan:Win32/Commando.A!ml. The attacker executed a second concealment binary, HideUL.exe, to suppress cursor visibility and reduce on-screen indicators of interactive remote control.
Neither incident involves a software vulnerability or CVE: the entire chain relies on social engineering (phishing + BiTB UI deception) and abuse of legitimate ScreenConnect trial/relay infrastructure to obtain hands-on remote access while evading a victim's visual detection and, in at least one case, real-time EDR signature detection. Huntress' 2026 Cyber Threat Report notes RMM abuse rose 277% year-on-year and now features in roughly a quarter of investigated incidents, consistent with a broader industry trend of threat actors preferring 'living off trusted software' (legitimate, code-signed RMM tools reconfigured to attacker-controlled relays) over custom malware to blend into normal IT traffic.
MITRE ATT&CK techniques used in TL-2026-2453
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1564 Hide Artifacts
Execution
T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1204.001 User Execution: Malicious Link; T1204.002 User Execution: Malicious File
Command and Control
T1090.002 Proxy: External Proxy; T1219 Remote Access Tools
Persistence
T1543.003 Create or Modify System Process: Windows Service
Privilege Escalation
T1543.003 Create or Modify System Process: Windows Service
Initial Access
T1566.002 Phishing: Spearphishing Link
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1583.006 Acquire Infrastructure: Web Services
Affected products and versions in Browser-in-the-Browser Phishing Campaign Abuses
- ConnectWise — ScreenConnect
Vulnerable versions: all - abused via rogue trial-instance/relay deployment rather than a version-specific vulnerability
Remediation for Browser-in-the-Browser Phishing Campaign Abuses
Immediate actions
- Inventory all ScreenConnect (and other RMM) instances installed in the environment and immediately terminate any instance ID not provisioned or approved by IT/the managing MSP
- Block network egress to the identified relay/C2 infrastructure: instance-uxh86b-relay.screenconnect.com, relay.goldenmelon.us, relay.illuminantgroup.net, scx.illuminantgroup.net, and 144.172.115.59:8041
- Isolate and forensically image any endpoint observed running HideCursor.exe or HideUL.exe
- Reset credentials and review MFA/session activity for any account associated with a compromised endpoint
Workarounds
- Enforce application allowlisting (AppLocker/WDAC) to block execution of unsigned or newly-downloaded installers from Downloads/Temp directories
- Restrict outbound RMM/relay traffic to a pinned, organization-approved instance ID or relay host via egress firewall rules
Longer-term hardening
- Implement an approved-RMM allowlist and alert on installation of any unapproved remote-access/RMM software (maps to T1219)
- Deploy EDR detections for ScreenConnect Windows-service creation from non-standard install paths or unrecognized instance IDs
- Add network detection for outbound connections to *.screenconnect.com trial-relay subdomains that do not match the organization's known/approved instance ID
- Run recurring user-awareness training covering Browser-in-the-Browser lures and unsolicited 'update your PDF reader' prompts
Weaknesses (CWE) in Browser-in-the-Browser Phishing Campaign Abuses
CWE-451
Timeline of Browser-in-the-Browser Phishing Campaign Abuses
- Attacker executes HideCursor.exe from C:\Users\REDACTED\Documents\ScreenConnect\Temp\ to conceal on-screen mouse activity.
- Attacker uses cmd.exe with curl from the first ScreenConnect session to install a second rogue client (instance 7c1d255d0efefde6) that beacons to C2 at 144.172.115.59:8041.
- First rogue ScreenConnect client (instance 9c1aea531ba4c511) installs as a Windows service, relaying through instance-uxh86b-relay.screenconnect.com.
- Victim executes ScreenConnect.ClientSetup.exe (SHA256 41d2097e8ac636a478aa011e12128c03b3b9bb3c8efca43d3c4f214ac8b1f07b), downloaded from the trial-relay subdomain hosthiifran.screenconnect.com.
- Victim is shown a Browser-in-the-Browser (BiTB) fake window spoofing get.adobe.com, prompting download of a fake Adobe PDF Reader update.
- Incident 1: victim receives a phishing email in Gmail with a link to a fake 'Safe access browser check' CAPTCHA lure at adoube.vu.
- Attacker executes HideUL.exe to suppress cursor visibility and reduce on-screen indicators of interactive remote-control activity.
- Second rogue client, delivered as patch.msi (instance c19e38a20f1ba492) from wir.consultingics.com, communicates with scx.illuminantgroup.net via relay.illuminantgroup.net; Microsoft Defender flags the binary as Trojan:Win32/Commando.A!ml.
- First rogue ScreenConnect client (instance d751818fd46e5ca9) installs as a Windows service, relaying through relay.goldenmelon.us.
- BiTB fake Adobe browser page prompts download of AdbRdBkUpsStUp.msi, staged on the DigitalOcean Spaces bucket victory.mkc1.digitaloceanspaces.com.
- Incident 2: victim receives a phishing message via AT&T Office@Hand (RingCentral) with a link to a fake PDF-viewer page at selectstructure.com.au.
- Huntress publishes 'Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence,' documenting both incidents.
Sources cited for Browser-in-the-Browser Phishing Campaign Abuses
- Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence
- Huntress Uncovers Phishing Attacks Using Fake Browser Pages and Rogue RMM Tools
- Beware — these new phishing attacks use a convincing fake Adobe Reader pages to trick victims into installing malware
- Browser-in-the-Browser phishing is on the rise: Here's how to spot it
- Phishing Pages Impersonate Adobe to Deploy Rogue ScreenConnect Clients
- Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence — Threat Radar
- Huntress Uncovers Phishing Attacks Using Fake Browser Pages and Rogue RMM Tools
- New Phishing Campaign Abuses ConnectWise ScreenConnect to Take Over Devices (related RMM-abuse trend)
- Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts (related RMM-abuse trend)
More in phishing
- Large-Scale Azure-Hosted Tech Support Scam Campaign Targets Japan (13.38M Emails, 240K+ Relay IPs, 33K+ Disposable Azure Blob Storage Sites)
- Phishing Campaign Impersonates ChatGPT Subscription Billing Alerts to Steal OpenAI Credentials via Google API Open-Redirect and nxcli.io Infrastructure
- Global Fake Parcel Delivery Phishing/Smishing Campaign Steals Card and Bank Details
- Fake myGov 'Secure Message' Phishing Scam Targets Australians with Multi-Step Identity Harvesting Flow
- Revolut Phishing SMS Campaign Follows Social-Engineering Data Breach Exposing 680 Customers' KYC Data
Detection coverage for TL-2026-2453
As of 2026-09-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2453 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.