---
id: "CMP-202610-phishing-emails-trick-users-into-installing-a-legitimate-zec"
kind: "campaign"
aliases: []
title: "Phishing emails trick users into installing a legitimate Zecurit Agent RMM configured by attackers for remote access (Unit 42)"
severity: "medium"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Zecurit Agent", "fixed": [], "vendor": "Zecurit"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-30T20:37:39+00:00"
updated_at: "2026-10-30T20:37:39+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-30T20:37:39+00:00"}]
---

# Phishing emails trick users into installing a legitimate Zecurit Agent RMM configured by attackers for remote access (Unit 42)

Unit 42 reports ongoing phishing emails using fake notices and invitation lures that lead victims to install the legitimate Zecurit Agent remote monitoring and management (RMM) tool, configured by the attackers, giving them remote access to the Windows PC. Installers use deceptive names such as documentpdf[.]exe and ViewDoc[.]exe. Anyone whose users can install software from email links is at risk. Ongoing as of 2026-10-30; start date, targets and attacker infrastructure unknown (Unit 42's full write-up not yet read).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Zecurit Agent affected ? fixed ?

## How to check

Look for the Zecurit Agent installed on endpoints where your IT does not use Zecurit, and for executables named documentpdf.exe or ViewDoc.exe (or other document-themed .exe names) downloaded from email links. Connections to Zecurit tenants that are not yours are another sign.

## Fix

Block or allowlist RMM tools so that only the ones your IT approves can run (block Zecurit Agent if you don't use it); remove unapproved Zecurit Agent installs and isolate affected hosts for investigation; warn users about document/invitation lures that download .exe files.

## Timeline

- 2026-10-30T20:37:39+00:00 analyst

## Documents

- [describes] @Unit42_Intel: Ongoing #phishing emails use fake notices and invitation lures to lead potential https://x.com/Unit42_Intel/status/2116265918867070977

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_