ScanMalware.com
Known malicious kitcriticalphishing

Fake 'PDF Viewer' page that pushes an Acrobat Reader installer which is really a remote-access agent

family: fake-acrobat-pdf-viewer-rmm-kit-2026-11
Short link:scanmalware.com/h/333

A page titled 'PDF Viewer' shows a blurred document and says it can only be opened after installing Adobe Acrobat Reader. The 'installer' is a remote-management agent (mostly ScreenConnect, sometimes Action1) set up to connect to the operator, which gives them control of the computer. The page lets only Windows desktop visitors through (others see a 'Windows Computer Required' notice), traps automated visitors, and in newer copies reports each visitor to the operator's Telegram. Some copies ask for an e-mail sign-in instead and send the visitor on to a fake login page. Copies sit on free app-hosting subdomains, short-lived domains and hacked websites.

Anchors

Hunting ruleFake_Acrobat_Reader_PDF_Viewer_Installer_Kit
SMQL queryrun
telegram_bot:6625069178 OR telegram_bot:7446308666 OR telegram_bot:7606371872 OR telegram_bot:7736808840 OR telegram_bot:8164902189 OR telegram_bot:8319075875 OR telegram_bot:8335859599 OR telegram_bot:8384114785 OR telegram_bot:8462063707 OR telegram_bot:8682503150 OR telegram_bot:8702662005 OR telegram_bot:8743312809 OR telegram_bot:8746891410 OR telegram_bot:8819893780 OR telegram_bot:8841510683 OR telegram_bot:9182586604

Provenance

Added: 2026-11-01 09:59
Matches the page's own code wherever it is served: its visitor trap, its Windows-only gate, the fake viewer and the delayed download, not the Adobe brand, so the brand's own pages cannot match. Also tracks the operators' Telegram bots.

Sightings (189)Atom feed

HostScanScriptMatchScanned
elaf.com.egde3435b0…http://elaf.com.eg/adobe-document.co#htmlrule2026-11-01 15:45
elaf.com.egde3435b0…https://elaf.com.eg/adobe-document.co/rule2026-11-01 15:45
elaf.com.ege3efbd2e…https://elaf.com.eg/adobe-document.co/#htmlrule2026-11-01 08:50
elaf.com.eg70c62e27…https://elaf.com.eg/adobe-document.co/#htmlrule2026-11-01 00:45
pomarosahotel.comd962f072…https://pomarosahotel.com/Adobe_Installer.html#htmlrule2026-10-31 05:50
pomarosahotel.comd962f072…—query2026-10-31 05:50
mx-flow.def98e6f5c…https://mx-flow.de/help/wollinkaa/WollinkaWollinkaAttorneys.html#htmlrule2026-10-31 02:50
amnesiacuracao.com6371e511…http://amnesiacuracao.com/adobe/adobe.html#htmlrule2026-10-31 00:45
amnesiacuracao.com6371e511…—query2026-10-31 00:45
pomarosahotel.comd3903180…https://pomarosahotel.com/Adobe_Installer.html#htmlrule2026-10-31 00:45
pomarosahotel.comd3903180…—query2026-10-31 00:45
www.floridahelath-theta.vercel.app702d5f9c…https://www.floridahelath-theta.vercel.app/#htmlrule2026-10-30 19:58
floridahelath-theta.vercel.app702d5f9c…—query2026-10-30 19:58
www.flhealthlicense-rosy.vercel.appc9593fd4…https://www.flhealthlicense-rosy.vercel.app/#htmlrule2026-10-30 19:49
flhealthlicense-rosy.vercel.appc9593fd4…—query2026-10-30 19:49
www.flhealthlicense-rosy.vercel.app49ec4689…http://www.flhealthlicense-rosy.vercel.app/#htmlrule2026-10-30 16:45
flhealthlicense-rosy.vercel.app49ec4689…—query2026-10-30 16:45
www.flhealthlicense-nu.vercel.app48e87189…https://www.flhealthlicense-nu.vercel.app/#htmlrule2026-10-30 14:45
flhealthlicense-nu.vercel.app48e87189…—query2026-10-30 14:45
www.floridahelath-theta.vercel.app53fc7e22…https://www.floridahelath-theta.vercel.app/#htmlrule2026-10-30 14:45
floridahelath-theta.vercel.app53fc7e22…—query2026-10-30 14:45
www.healthlicense-blond.vercel.app8acada59…https://www.healthlicense-blond.vercel.app/#htmlrule2026-10-30 13:54
healthlicense-blond.vercel.app8acada59…—query2026-10-30 13:54
floridahelath-theta.vercel.appc3d14fce…http://floridahelath-theta.vercel.app/#htmlrule2026-10-30 02:45
floridahelath-theta.vercel.appc3d14fce…—query2026-10-30 02:45
flhealthlicense-nu.vercel.appc8c9bc06…https://flhealthlicense-nu.vercel.app/#htmlrule2026-10-30 02:45
flhealthlicense-nu.vercel.appc8c9bc06…—query2026-10-30 02:45
flhealthlicense-rosy.vercel.app104d2603…https://flhealthlicense-rosy.vercel.app/#htmlrule2026-10-30 02:45
flhealthlicense-rosy.vercel.app104d2603…—query2026-10-30 02:45
www.healthlicense-zeta.vercel.appbc9008c5…http://www.healthlicense-zeta.vercel.app/#htmlrule2026-10-30 01:45
healthlicense-zeta.vercel.appbc9008c5…—query2026-10-30 01:45
www.healthlicense-blond.vercel.app51898cb1…https://www.healthlicense-blond.vercel.app/#htmlrule2026-10-30 01:45
healthlicense-blond.vercel.app51898cb1…—query2026-10-30 01:45
www.flhealthlicense-three.vercel.appc824c12c…https://www.flhealthlicense-three.vercel.app/#htmlrule2026-10-29 17:45
flhealthlicense-three.vercel.appc824c12c…—query2026-10-29 17:45
www.healthlicense-tau.vercel.app01a8aa89…http://www.healthlicense-tau.vercel.app/#htmlrule2026-10-29 15:45
healthlicense-tau.vercel.app01a8aa89…—query2026-10-29 15:45
healthlicense-blond.vercel.app25f91792…https://healthlicense-blond.vercel.app/#htmlrule2026-10-29 14:45
healthlicense-blond.vercel.app25f91792…—query2026-10-29 14:45
healthlicense-zeta.vercel.app7818fa89…https://healthlicense-zeta.vercel.app/#htmlrule2026-10-29 14:45
healthlicense-zeta.vercel.app7818fa89…—query2026-10-29 14:45
equiperallysolucionatica.com.brb035d9d7…https://equiperallysolucionatica.com.br/Adobe_Installer.html#htmlrule2026-10-29 02:45
equiperallysolucionatica.com.brb035d9d7…—query2026-10-29 02:45
flhealthlicense-three.vercel.app5d19f63c…https://flhealthlicense-three.vercel.app/#htmlrule2026-10-29 00:45
flhealthlicense-three.vercel.app5d19f63c…—query2026-10-29 00:45
healthlicense-tau.vercel.app0946ed18…http://healthlicense-tau.vercel.app/#htmlrule2026-10-29 00:45
healthlicense-tau.vercel.app0946ed18…—query2026-10-29 00:45
hameem.net10727f92…https://hameem.net/adobe.live/index.html#htmlrule2026-10-29 00:45
www.floridahealth-gamma.vercel.app2580a24f…https://www.floridahealth-gamma.vercel.app/#htmlrule2026-10-28 14:45
floridahealth-gamma.vercel.app2580a24f…—query2026-10-28 14:45
www.floridahealth-plum.vercel.appe81947b4…http://www.floridahealth-plum.vercel.app/#htmlrule2026-10-28 14:45
floridahealth-plum.vercel.appe81947b4…—query2026-10-28 14:45
www.healthlicensefl-amber.vercel.app1321a4b2…http://www.healthlicensefl-amber.vercel.app/#htmlrule2026-10-28 14:45
healthlicensefl-amber.vercel.app1321a4b2…—query2026-10-28 14:45
www.healthlicensefl.vercel.app9f3ac110…http://www.healthlicensefl.vercel.app/#htmlrule2026-10-28 14:45
healthlicensefl.vercel.app9f3ac110…—query2026-10-28 14:45
hameem.net710ff5d5…https://hameem.net/adobe.pw/index.html#htmlrule2026-10-28 14:45
www.healthlicensefl-beta.vercel.appd7e7faba…http://www.healthlicensefl-beta.vercel.app/#htmlrule2026-10-28 13:45
healthlicensefl-beta.vercel.appd7e7faba…—query2026-10-28 13:45
flhealthlicense-tawny.vercel.appd21be992…http://flhealthlicense-tawny.vercel.app/#htmlrule2026-10-28 13:45
flhealthlicense-tawny.vercel.appd21be992…—query2026-10-28 13:45
www.flhealthlicense-tawny.vercel.appb0c90241…https://www.flhealthlicense-tawny.vercel.app/#htmlrule2026-10-28 12:45
flhealthlicense-tawny.vercel.appb0c90241…—query2026-10-28 12:45
skyloghomes.com20fd77a1…https://skyloghomes.com/on/#htmlrule2026-10-28 11:50
hameem.netfce33f7e…https://hameem.net/adobe.com/index.html#htmlrule2026-10-28 01:45
flhealthlicense.vercel.app139598a6…http://flhealthlicense.vercel.app/#htmlrule2026-10-28 01:45
flhealthlicense.vercel.app139598a6…—query2026-10-28 01:45
tiendatigard.com.mx083023a7…http://tiendatigard.com.mx/work/Adobe_Installer.html?mc_phishing_protection_id=191110-dbgdp49h9tjvg075eig0#htmlrule2026-10-28 01:45
tiendatigard.com.mx083023a7…—query2026-10-28 01:45
healthlicensefl-beta.vercel.app1a155bb3…http://healthlicensefl-beta.vercel.app/#htmlrule2026-10-28 00:45
healthlicensefl-beta.vercel.app1a155bb3…—query2026-10-28 00:45
healthlicensefl-amber.vercel.app50f9f1e7…http://healthlicensefl-amber.vercel.app/#htmlrule2026-10-28 00:45
healthlicensefl-amber.vercel.app50f9f1e7…—query2026-10-28 00:45
floridahealth-plum.vercel.app75d0dafd…https://floridahealth-plum.vercel.app/#htmlrule2026-10-28 00:45
floridahealth-plum.vercel.app75d0dafd…—query2026-10-28 00:45
floridahealth-gamma.vercel.appb992636e…https://floridahealth-gamma.vercel.app/#htmlrule2026-10-28 00:45
floridahealth-gamma.vercel.appb992636e…—query2026-10-28 00:45
healthlicensefl.vercel.app38db87ff…http://healthlicensefl.vercel.app/#htmlrule2026-10-28 00:45
healthlicensefl.vercel.app38db87ff…—query2026-10-28 00:45
www.flhealthlicense.vercel.app46daed27…http://www.flhealthlicense.vercel.app/#htmlrule2026-10-28 00:45
flhealthlicense.vercel.app46daed27…—query2026-10-28 00:45
abenetgeneralservices.ca28343d8d…https://abenetgeneralservices.ca/secure/Adobe_Installer.html#htmlrule2026-10-27 16:45
wh1562215.ispot.ccc627896d…https://wh1562215.ispot.cc/Adobe/pages/github/index.html#[email protected]#htmlrule2026-10-27 08:08
hameem.net0997f326…https://hameem.net/adobe.co/index.html#htmlrule2026-10-27 02:45
apoyar.org7afcd151…https://apoyar.org/adobe.html#htmlrule2026-10-26 12:45
adobeinstaller-virid.vercel.app1e8561c7…http://adobeinstaller-virid.vercel.app/#htmlrule2026-10-25 12:45
adobeinstaller-virid.vercel.app1e8561c7…—query2026-10-25 12:45
rlp.dupintt.comf79c0af8…https://rlp.dupintt.com/data/voice-service-verify/#htmlrule2026-10-25 04:53
rlp.dupintt.comf79c0af8…—query2026-10-25 04:53
www.csrdrywallss.vercel.appafb26d02…https://www.csrdrywallss.vercel.app/#htmlrule2026-10-24 14:45
csrdrywallss.vercel.appafb26d02…—query2026-10-24 14:45
mx-flow.dede06403a…https://mx-flow.de/help/wollinkaa/WollinkaWollinkaAttorneys.html#htmlrule2026-10-24 01:50
csrdrywallss.vercel.app3fa9a028…https://csrdrywallss.vercel.app/#htmlrule2026-10-24 01:45
csrdrywallss.vercel.app3fa9a028…—query2026-10-24 01:45
www.pdf-viewer-five-virid.vercel.appaf54954f…https://www.pdf-viewer-five-virid.vercel.app/#htmlrule2026-10-23 12:45
www.new-indexproject.vercel.appb4a1494b…https://www.new-indexproject.vercel.app/#htmlrule2026-10-23 03:45
new-indexproject.vercel.appb4a1494b…—query2026-10-23 03:45
pdf-viewer-five-virid.vercel.app2542d08b…http://pdf-viewer-five-virid.vercel.app/#htmlrule2026-10-22 14:45
www.index-catty-neww.vercel.appaf3cef68…http://www.index-catty-neww.vercel.app/#htmlrule2026-10-22 14:45
index-catty-neww.vercel.appaf3cef68…—query2026-10-22 14:45
www.index-newproject.vercel.appa1dcc35b…https://www.index-newproject.vercel.app/#htmlrule2026-10-22 13:45
index-newproject.vercel.appa1dcc35b…—query2026-10-22 13:45
new-indexproject.vercel.app26c87666…http://new-indexproject.vercel.app/#htmlrule2026-10-22 12:45
new-indexproject.vercel.app26c87666…—query2026-10-22 12:45
index-newproject.vercel.app843c8a08…https://index-newproject.vercel.app/#htmlrule2026-10-22 01:45
index-newproject.vercel.app843c8a08…—query2026-10-22 01:45
index-catty-neww.vercel.app814a1f95…https://index-catty-neww.vercel.app/#htmlrule2026-10-22 00:45
index-catty-neww.vercel.app814a1f95…—query2026-10-22 00:45
skyloghomes.com66316574…https://skyloghomes.com/on/#htmlrule2026-10-21 10:50
hernunspnc.github.io6a442836…https://hernunspnc.github.io/Adobe_Reader.github.io/#htmlrule2026-10-20 12:45
hernunspnc.github.io6a442836…—query2026-10-20 12:45
peputragroup.com4de7af16…http://peputragroup.com/Adobe_Installer.html#htmlrule2026-10-18 03:45
peputragroup.com4de7af16…—query2026-10-18 03:45
hipercromo.com.bre8875466…https://hipercromo.com.br/Adobe_Installer.html#htmlrule2026-10-17 09:50
hipercromo.com.bre8875466…—query2026-10-17 09:50
mx-flow.de95099899…https://mx-flow.de/help/wollinkaa/WollinkaWollinkaAttorneys.html#htmlrule2026-10-17 00:50
hipercromo.com.br91312cd7…https://hipercromo.com.br/Adobe_Installer.html#htmlrule2026-10-17 00:45
hipercromo.com.br91312cd7…—query2026-10-17 00:45
docsewallet.com41df1c90…https://docsewallet.com/Adobe_Installer.html#htmlrule2026-10-16 15:45
docsewallet.com41df1c90…—query2026-10-16 15:45
nhhydraulik.co.in1c7075f5…https://nhhydraulik.co.in/secure/Adobe_Installer.html#htmlrule2026-10-16 03:45
nhhydraulik.co.in1c7075f5…—query2026-10-16 03:45
browardcourtpdf-viewer.vercel.appefd66e6c…https://browardcourtpdf-viewer.vercel.app/#htmlrule2026-10-16 01:45
browardcourtpdf-viewer.vercel.appefd66e6c…—query2026-10-16 01:45
www.browardcourtpdf-viewer.vercel.app5d800def…http://www.browardcourtpdf-viewer.vercel.app/#htmlrule2026-10-16 00:45
browardcourtpdf-viewer.vercel.app5d800def…—query2026-10-16 00:45
www.adobeinstaller-virid.vercel.appc3abad7b…http://www.adobeinstaller-virid.vercel.app/#htmlrule2026-10-11 12:45
adobeinstaller-virid.vercel.appc3abad7b…—query2026-10-11 12:45
www.browardpdf-viewer.vercel.appde925dc7…https://www.browardpdf-viewer.vercel.app/#htmlrule2026-10-11 01:45
browardpdf-viewer.vercel.appde925dc7…—query2026-10-11 01:45
www.browardcountypdf-viewer.vercel.app683e5d62…http://www.browardcountypdf-viewer.vercel.app/#htmlrule2026-10-11 01:45
browardcountypdf-viewer.vercel.app683e5d62…—query2026-10-11 01:45
adobeinstaller-virid.vercel.app65b94d4c…https://adobeinstaller-virid.vercel.app/#htmlrule2026-10-11 00:45
adobeinstaller-virid.vercel.app65b94d4c…—query2026-10-11 00:45
fllicensehealthpdf-viewer.vercel.app4c57f092…http://fllicensehealthpdf-viewer.vercel.app/#htmlrule2026-10-11 00:45
www.fllicensehealthpdf-viewer.vercel.app2f3ffa89…http://www.fllicensehealthpdf-viewer.vercel.app/#htmlrule2026-10-11 00:45
browardcountypdf-viewer.vercel.app172ab67e…https://browardcountypdf-viewer.vercel.app/#htmlrule2026-10-10 12:45
browardcountypdf-viewer.vercel.app172ab67e…—query2026-10-10 12:45
browardpdf-viewer.vercel.appf9e775f6…https://browardpdf-viewer.vercel.app/#htmlrule2026-10-10 12:45
browardpdf-viewer.vercel.appf9e775f6…—query2026-10-10 12:45
1yz.com210ec478…https://1yz.com/secure/Adobe_Installer.html#htmlrule2026-10-10 00:45
mx-flow.de828c3692…https://mx-flow.de/help/wollinkaa/WollinkaWollinkaAttorneys.html#htmlrule2026-10-09 22:50
marycar.com.br027ea9fb…https://marycar.com.br/Adobe/Acrobat_Reader/#htmlrule2026-10-08 11:50
marycar.com.br027ea9fb…—query2026-10-08 11:50
luxora.qpon25fe5254…https://luxora.qpon/AdobeInstaller.html#htmlrule2026-10-07 13:50
www.pdf-viewer-five-virid.vercel.app176e45bc…http://www.pdf-viewer-five-virid.vercel.app/#htmlrule2026-10-05 13:45
pdf-viewer-five-virid.vercel.app26883128…https://pdf-viewer-five-virid.vercel.app/#htmlrule2026-10-05 13:45
karrasconsulting.netab32557d…https://karrasconsulting.net/instqll/adobe/index2.html#htmlrule2026-10-03 08:50
karrasconsulting.netab32557d…—query2026-10-03 08:50
karrasconsulting.netef81b3b0…http://karrasconsulting.net/instqll/adobe/index2.html#htmlrule2026-10-03 00:45
karrasconsulting.netef81b3b0…—query2026-10-03 00:45
mx-flow.de385e0b96…https://mx-flow.de/help/wollinkaa/WollinkaWollinkaAttorneys.html#htmlrule2026-10-02 21:50
luxfab.luxe0d9e65ce…http://luxfab.luxe/Adobe_Installer.html#htmlrule2026-10-02 02:45
nilehost.cloude940bde4…https://nilehost.cloud/Adobe_Inz.html#htmlrule2026-10-01 14:45
strutsupportsystems.com87205dcb…https://strutsupportsystems.com/Adobe_Installer.html#htmlrule2026-10-01 14:45
marycar.com.br7e67db1d…https://marycar.com.br/Adobe/Acrobat_Reader/#htmlrule2026-10-01 10:50
d-fr7.livee3426bf7…https://d-fr7.live/view/pages/github/index.html#[email protected]#htmlrule2026-09-30 15:19
wh1562215.ispot.cca17f15c2…https://wh1562215.ispot.cc/Adobe/pages/github/index.html#[email protected]#htmlrule2026-09-30 15:18
luxora.qpon2e475878…https://luxora.qpon/AdobeInstaller.html#htmlrule2026-09-30 12:50
gm.cvouab.comddb4f40a…https://gm.cvouab.com/xyz/Adobe_Installer.html#htmlrule2026-09-30 12:50
audtfnaurth.com.esa9e95f73…https://audtfnaurth.com.es/8nde11/adobe-reader?73920038488.adobe.com/document/93048-3940-3998-3404#htmlrule2026-09-30 01:45
luxora.qpon05235739…https://luxora.qpon/AdobeInstaller.html#htmlrule2026-09-30 00:45
gm.cvouab.com2a8e7479…https://gm.cvouab.com/xyz/Adobe_Installer.html#htmlrule2026-09-30 00:45
dndair.come28c3cc5…https://dndair.com/iv/doc.html#htmlrule2026-09-29 13:50
vr.znbbmwq.com76a58f58…https://vr.znbbmwq.com/inv/Adobe_Installer.html#htmlrule2026-09-26 00:45
mx-flow.decbcf23c8…https://mx-flow.de/help/wollinkaa/WollinkaWollinkaAttorneys.html#htmlrule2026-09-25 20:50
mauihost.qpon7e3cba31…https://mauihost.qpon/AdobeInstaller.html#htmlrule2026-09-25 13:45
fitfur.qponf5517c1e…https://fitfur.qpon/AdobeInstaller.html#htmlrule2026-09-25 00:45
marycar.com.br00b7de74…https://marycar.com.br/Adobe/Acrobat_Reader/#htmlrule2026-09-24 09:50
www.taslimaenterprise.comed417adf…https://www.taslimaenterprise.com/adobe/#htmlrule2026-09-19 12:45
marycar.com.br1776abb7…http://marycar.com.br/Adobe/Acrobat_Reader#htmlrule2026-09-19 00:45
mx-flow.debbf53fa2…https://mx-flow.de/help/wollinkaa/WollinkaWollinkaAttorneys.html#htmlrule2026-09-18 19:50
marycar.com.br6df6bf2a…https://marycar.com.br/Adobe/Acrobat_Reader/#htmlrule2026-09-17 08:51
gaelik.com18b59c71…https://gaelik.com/ftx/adobe.html#htmlrule2026-09-16 00:45
mx-flow.de7ab59c34…https://mx-flow.de/help/wollinkaa/WollinkaWollinkaAttorneys.html#htmlrule2026-09-11 18:50
marycar.com.brc653ef38…https://marycar.com.br/Adobe/Acrobat_Reader/#htmlrule2026-09-10 06:51
zentexa.com5a70a772…https://zentexa.com/acrobat/dc#htmlrule2026-09-10 00:45
at.lcnsrqo.com18904922…https://at.lcnsrqo.com/rdrddr/rdr1.html#htmlrule2026-09-09 08:50
marycar.com.brccdf4e4b…https://marycar.com.br/Adobe/Acrobat_Reader/#htmlrule2026-09-03 05:51
marycar.com.br4bc67ebc…https://marycar.com.br/Adobe/Acrobat_Reader/#htmlrule2026-08-27 04:50
marycar.com.br7be86520…https://marycar.com.br/Adobe/Acrobat_Reader/#htmlrule2026-08-20 00:50
marycar.com.brf427652c…https://marycar.com.br/Adobe/Acrobat_Reader/#htmlrule2026-08-04 00:45
mikka-style.roebdb5b47…https://mikka-style.ro/event/aDobe.html#htmlrule2026-08-04 00:45
ds.lafqld.netdaa4fec9…https://ds.lafqld.net/encrypted_proposal/Adobe_Installer.html#htmlrule2026-07-30 01:45
ectreatment.com4b7f4720…https://ectreatment.com/images/adobesc.html#htmlrule2026-07-29 13:45
zoommeet.vu698e461e…https://zoommeet.vu/adobegerm/adobe.html#htmlrule2026-07-29 00:45
thesocialnexus.co.zaee1a0b08…https://thesocialnexus.co.za/redire/Adobe_Installer.html#htmlrule2026-07-23 01:45
www.tikidesigns.com.au8cc0574d…http://www.tikidesigns.com.au/bt/Adobe___Installer.html#htmlrule2026-07-15 04:45
shringdoc.shope8138de0…https://shringdoc.shop/Adobe_Installer#htmlrule2026-06-11 01:46