Phishing

A trojanized Atera RMM installer disguised as a bank eStatement PDF grants attackers persistent remote access including terminal, remote desktop, and arbitrary code execution — all through legitimately signed, commercially trusted infrastructure. Zero public detections at time of analysis. Likely Luna Moth / Silent Ransom Group campaign.

TLP: WHITE — This analysis is cleared for public release. All victim PII has been redacted. No credentials were submitted during analysis. IOCs are provided at the end for detection use. Overview A live QR phishing (“quishing”) campaign was captured in the wild targeting corporate employees via a weaponized PDF disguised as an employee handbook. This isn’t a commodity phish — it’s a toolkit-grade, multi-stage attack built specifically to defeat automated email scanners, security sandboxes, and network proxies. ...