Read Time:3 Minute, 42 Second

A newly discovered malware-as-a-service (MaaS) operation is using a convincing fake Adobe Acrobat Reader website to push information-stealing and banking-fraud malware onto Windows machines, according to research shared with Cyber Security News by the analyst known as Clandestine. The platform, internally identified as “SecureWorkspace WebPanel” and built on a backend dubbed “Kaido Panel,” gives even low-skilled operators a point-and-click way to launch financially motivated attacks.

A Trusted Brand as Bait

The campaign’s front door is acrobatreaderonline.com, a domain registered in June 2026 that closely mimics Adobe’s real download pages. Because Adobe Acrobat Reader is one of the most widely trusted and widely installed pieces of software in the world, a lookalike site immediately lowers a victim’s guard. Targets typically arrive at the page through document lures, including fake PDFs and boleto-style payment forms, that are crafted to look like ordinary paperwork rather than a security threat.

The WebDAV and Batch File Trick

Rather than serving a conventional executable download, which browsers and endpoint tools are increasingly good at flagging, the operation abuses Windows’ built-in WebDAV client. By pointing victims at a remote WebDAV folder, the attackers can make malicious content appear inside Windows File Explorer in a way that looks far less suspicious than a typical download prompt. From there, a .bat (batch script) file does the actual dirty work.

Batch files still carry an outdated reputation as harmless text-based scripts, but in Windows they can execute arbitrary system commands with the same privileges as the user who opens them. In this campaign, the batch file quietly triggers the next stage of the infection chain once a victim opens what appears to be a routine document.

What the Malware Actually Does

Once installed, the payload is built around financial theft. According to the researcher’s analysis, the panel’s backend includes dedicated modules for general information stealing, banking overlay attacks that intercept login credentials on financial sites, and fraud aimed specifically at Brazil’s PIX instant-payment system and boleto payment slips. That regional focus suggests the operators are primarily targeting Brazilian and broader Latin American users, though the underlying platform could be pointed at other regions just as easily.

The control panel itself is built with modern web technology (Vite, React, and Tailwind CSS) and is gated behind bearer-token authentication, with a “loot” section for reviewing stolen data and a SignalR-based communication hub for real-time command and control. In other words, this isn’t a hobbyist tool: it’s built with the same engineering discipline as a legitimate SaaS product, just repurposed for crime.

Infrastructure and Indicators

Investigators linked the primary domain to a wider cluster of infrastructure sharing the same Cloudflare nameservers, including kaido.sh and its subdomains, which previously hosted a WebDAV-based loader. Known indicators associated with the campaign include:

• Domains: acrobatreaderonline[.]com, kaido[.]sh, free.kaido[.]sh, x4m1k[.]com
• IP addresses: 104.21.2[.]104, 172.67.129[.]21, and 185.208.158[.]27
• A Windows WebDAV cache artifact left in the TfsStore\Tfs\_DAV directory
• Use of the Windows WebClient service and a session identifier referenced as “kaido_token”

Why This Matters

The campaign is a reminder that brand impersonation and living-off-the-land techniques remain far more effective than exotic zero-days for most attackers. Combining a trusted software brand with a native Windows feature like WebDAV lets criminals sidestep many of the download warnings that browsers and antivirus tools have gotten better at catching, while a batch file dropper exploits the lingering assumption that scripts are less dangerous than .exe files.

Recommendations for Defenders

• Block the known domains and IP addresses at the DNS, proxy, and email gateway level, and review logs for any historical connections to them.
• Monitor endpoints for unexpected WebClient service activity and for the TfsStore cache artifact described above.
• Remind users to download Acrobat Reader only from adobe.com, and to treat unsolicited document links, especially ones tied to payments, with suspicion.
• Watch for unusual outbound connections to remote WebDAV shares, which are rarely used in normal business workflows.
• Preserve relevant logs before remediating an infected machine, since MaaS operators frequently reuse infrastructure across multiple victims.

As MaaS platforms like this one continue to lower the technical bar for financially motivated cybercrime, organizations that process payments or handle sensitive financial documents should treat brand-impersonation domains as a standing threat rather than a one-off incident.

Share

Facebook
Twitter
Pinterest
LinkedIn

Read Time:3 Minute, 28 Second

Security researchers have disclosed a vulnerability in the Adobe Acrobat PDF extension for Chrome that could have let attackers silently read a victim’s open WhatsApp Web conversations simply by getting them to visit a booby-trapped webpage — no downloads, credential theft, or suspicious clicks required. Given that the extension ships on an estimated 314 to 329 million browsers worldwide, the flaw represented one of the broader privacy exposures uncovered in a mainstream browser extension this year.

A Dormant Feature Turned Into an Attack Path

The flaw, nicknamed “HermeticReader” by the Guardio Labs researchers who found it and formally tracked as CVE-2026-48294 with a CVSS score of 7.4, is classified as a universal cross-site scripting (UXSS) bug. In plain terms, it allowed a malicious site to break out of the browser’s normal isolation rules and reach into data tied to a completely different tab — in this case, an open WhatsApp Web session.

What makes the discovery notable is that the exploited functionality wasn’t even an active, advertised feature. Buried inside the extension was a dormant WhatsApp Web integration engine, internally referred to as “Hermes,” that Guardio’s researchers found could be switched on by an attacker without the user’s knowledge.

How the Attack Chain Worked

The exploit unfolded in a sequence of quiet, individually unremarkable steps. First, a hidden iframe embedded in the malicious page communicated with the extension’s background service worker — a component that, critically, never verified who was actually sending it messages. That gap allowed the attacker to write arbitrary data into the extension’s local storage, flipping a hidden flag that activated the dormant Hermes engine.

From there, the malicious page opened WhatsApp Web in a background tab and guessed its numeric tab identifier by taking advantage of how Chrome assigns tab IDs sequentially. Once it had that ID, the attacker could send commands straight to Hermes’s content script running inside the WhatsApp tab, manipulating the page’s structure at will.

The final step required no injected scripts to actually execute. Instead, the compromised engine planted a hidden form on the WhatsApp Web page and used ordinary, legitimate browser operations to relocate the live chat contents into that form. Because a hidden field inside the form lacked a proper “value” attribute, submitting it caused the browser to transmit the entire visible page — chat lists, contact names, message previews, and any open conversation — directly to a server controlled by the attacker. WhatsApp Web’s content security policy didn’t restrict where forms could submit data, so the browser allowed the cross-origin transfer without complaint.

What Was and Wasn’t Exposed

Guardio’s researchers were careful to note an important nuance: the data captured was limited to on-screen, rendered text rather than WhatsApp’s underlying encrypted message payloads. For most users, though, that’s a technical distinction with little practical comfort — the visible content of their conversations is, for all intents and purposes, the sensitive material they’d want protected in the first place.

A Fast Fix From Adobe

To its credit, Adobe moved quickly once Guardio’s team reported the issue through its PSIRT process. The company acknowledged, fixed, and shipped a patch in version 26.5.2.3 within a single weekend, with the formal CVE assignment following days later. Because the fix was distributed automatically through the Chrome Web Store, most users should already be protected, though security teams are advised to confirm that installed extension versions are current rather than assume the update applied silently.

A Bigger Pattern in Browser Extensions

Beyond the specifics of this one bug, the HermeticReader case highlights a growing category of risk: individually minor weaknesses in how extensions pass messages, validate storage writes, and gate feature flags can combine into a full account-level compromise chain. That risk scales dramatically in extensions with install bases in the hundreds of millions.

As more browser extensions build direct integrations with messaging platforms and other sensitive services, the unglamorous “plumbing” code connecting those pieces — rather than headline-grabbing zero-days — is emerging as one of the more consequential attack surfaces for both individual users and the organizations whose employees rely on these tools daily.

Share

Facebook
Twitter
Pinterest
LinkedIn