Attackers Weaponize Legitimate RMM Tools via Fake PDFs

According to AhnLab Security Intelligence Center (ASEC), threat actors are hijacking legitimate RMM software to infiltrate networks by abusing trusted tools such as Syncro, SuperOps, NinjaOne, and ScreenConnect. The campaign, active since at least October 2025, starts with deceptive PDFs that prompt users to download and run the RMM tool from a disguised distribution page after a phishing email.

The downloaded payload is a legitimate or slightly modified installer for enterprise-grade RMM software, providing remote access and enabling a Living-off-the-Land style operation. One NinjaOne downloader sample was built with NSIS, and its internal script downloads additional payloads from a malicious domain and installs the RMM agent without user consent.

The malware uses a signing certificate that ties the activity to attacks dating back to late 2025, complicating detection because the final payload can be a valid signed application used by many legitimate organisations. Organisations are urged to monitor for unauthorized RMM installations and to be cautious of PDFs that display “failed to load” messages, verifying senders and blocking known malicious domains associated with these campaigns.