In-Memory Loader Drops ScreenConnect

Reported 10 Apr 2026 by otx · Severity: medium

In February 2026, an attack chain was discovered that utilized a fraudulent Adobe Acrobat Reader download page to deceive victims into installing ConnectWise's ScreenConnect, a legitimate remote access tool exploited for malicious purposes. The attack employs sophisticated evasio