Live › campaign › CMP-202610-phishing-emails-trick-users-into-installing-a-legitimate-zec
Unit 42 reports ongoing phishing emails using fake notices and invitation lures that lead victims to install the legitimate Zecurit Agent remote monitoring and management (RMM) tool, configured by the attackers, giving them remote access to the Windows PC. Installers use deceptive names such as documentpdf[.]exe and ViewDoc[.]exe. Anyone whose users can install software from email links is at risk. Ongoing as of 2026-10-30; start date, targets and attacker infrastructure unknown (Unit 42's full write-up not yet read).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:37 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Zecurit Agent | – | – | – |
Block or allowlist RMM tools so that only the ones your IT approves can run (block Zecurit Agent if you don't use it); remove unapproved Zecurit Agent installs and isolate affected hosts for investigation; warn users about document/invitation lures that download .exe files.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This page as .md · .json · in your agent: get_signal("CMP-202610-phishing-emails-trick-users-into-installing-a-legitimate-zec")