{"id":"CMP-202610-phishing-emails-trick-users-into-installing-a-legitimate-zec","kind":"campaign","aliases":[],"related":[],"title":"Phishing emails trick users into installing a legitimate Zecurit Agent RMM configured by attackers for remote access (Unit 42)","description":null,"summary":"Unit 42 reports ongoing phishing emails using fake notices and invitation lures that lead victims to install the legitimate Zecurit Agent remote monitoring and management (RMM) tool, configured by the attackers, giving them remote access to the Windows PC. Installers use deceptive names such as documentpdf[.]exe and ViewDoc[.]exe. Anyone whose users can install software from email links is at risk. Ongoing as of 2026-10-30; start date, targets and attacker infrastructure unknown (Unit 42's full write-up not yet read).","severity":"medium","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-30T20:37:39+00:00","products":[{"name":"Zecurit Agent","fixed":[],"vendor":"Zecurit"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look for the Zecurit Agent installed on endpoints where your IT does not use Zecurit, and for executables named documentpdf.exe or ViewDoc.exe (or other document-themed .exe names) downloaded from email links. Connections to Zecurit tenants that are not yours are another sign.","fix":"Block or allowlist RMM tools so that only the ones your IT approves can run (block Zecurit Agent if you don't use it); remove unapproved Zecurit Agent installs and isolate affected hosts for investigation; warn users about document/invitation lures that download .exe files.","status":"open","published_at":null,"first_seen_at":"2026-10-30T20:37:39+00:00","triaged_at":"2026-10-30T20:37:39+00:00","updated_at":"2026-10-30T20:37:39+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':104B '-202610':21A '-30':105B '2026':103B '42':19A,39B,114B 'a':29A 'access':17A,72B 'agent':10A,33A,58B 'anyon':88B 'attack':14A,68B,110B 'campaign':34B 'cmp':20A 'configur':12A,65B 'date':107B 'decept':79B 'documentpdf':83B 'earli':36B 'early-warn':35B 'email':2A,43B,95B 'emails':24A 'exe':84B,87B 'fake':45B 'full':116B 'give':69B 'infrastructur':111B 'instal':6A,54B,77B,92B 'installing':28A 'into':27A 'invit':48B 'lead':51B 'legitim':8A,56B 'legitimate':30A 'link':96B 'lure':49B 'manag':62B 'monitor':60B 'name':80B 'notic':46B 'ongo':41B,100B 'pc':76B 'phish':1A,42B 'phishing':23A 'phishing-emails-trick-users-into-installing-a-legitimate-zec':22A 'read':122B 'remot':16A,59B,71B 'report':40B 'risk':99B 'rmm':11A,63B 'softwar':93B 'start':106B 'target':108B 'tool':64B 'trick':3A,25A 'unit':18A,38B,113B 'unknown':112B 'use':44B,78B 'user':4A,90B 'users':26A 'victim':52B 'viewdoc':86B 'warn':37B 'whose':89B 'window':75B 'write':118B 'write-up':117B 'yet':121B 'zec':31A 'zecurit':9A,32A,57B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-30T20:28:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-phishing-emails-trick-users-into-installing-a-legitimate-zec","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-30T20:37:39+00:00","fetched_at":"2026-10-30T20:37:39+00:00","note":null}],"documents":[{"id":25827,"url":"https://x.com/Unit42_Intel/status/2116265918867070977","title":"@Unit42_Intel: Ongoing #phishing emails use fake notices and invitation lures to lead potential","kind":"post","source":"x","publisher":null,"text":"Ongoing #phishing emails use fake notices and invitation lures to lead potential victims to install a legitimate #Zecurit Agent RMM configured by the attackers. The installers have deceptive names, like documentpdf[.]exe and ViewDoc[.]exe. Details at https://t.co/GOENUr6RXF https://t.co/hjMRzsbDlX\n\nlikes 22 reposts 6","published_at":"2026-10-30T20:28:08+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}