Known malicious kithighphishingCommunity hunt
Fake Acrobat Update Portal
Created by the ScanMalware community
Short link:scanmalware.com/h/332
Detects a fake Acrobat update portal that claims an encrypted document requires a software update and links to a VBS script and an executable.
Anchors
SMQL queryrun
link_host:pub-e5312c98a7484bb7b6af12487d54f3e9.r2.dev OR phash:bec9833ec13c36c1Provenance
Added: 2026-11-01 09:26
Anchors on the VBS link host pub-e5312c98a7484bb7b6af12487d54f3e9[.]r2[.]dev and the portal screenshot fingerprint bec9833ec13c36c1.