Fake Adobe 'Download Document' page delivering a remote-management agent

A fake Adobe file-sharing page, planted in a folder on compromised websites and on a few attacker-registered domains. A first page checks the visitor's browser and IP address and turns away Edge, Mac and mobile visitors; Windows visitors then see an Adobe-branded 'You've received a secured document' dialog over a picture of an Adobe file list, usually naming a document after the business the email targets. Its Download button leads to a page claiming an 'Adobe plugin' is missing, which silently downloads a file. That file is a genuine remote-management (RMM) agent pre-configured for the operator's own account (ScreenConnect, FleetDeck or GoTo Resolve, varying from site to site), sometimes wrapped in a batch or VBScript file that asks for administrator rights and installs it silently. Once installed, the operator has remote control of the computer. Reported on doboski[.]top on 2026-10-14, with a self-hosted ScreenConnect server at 2.27.21[.]82.