Hunt: phishing lures named Docusign.exe, documentpdf.exe, Evite.exe and ViewDoc.exe install a legitimately signed Zecurit Agent RMM enrolled to the attacker

vendor threat intel (Palo Alto Networks Unit 42 timely threat intel, Oct 29-30); legitimate signed RMM abused2026-10-30

Hunt: phishing lures named Docusign.exe, documentpdf.exe, Evite.exe and ViewDoc.exe install a legitimately signed Zecurit Agent RMM enrolled to the attacker

Unit 42 reports an ongoing phishing campaign posing as document-sharing notices and event invitations that installs Zecurit Agent, a commercial remote monitoring and management tool, configured by the attacker. Because the installers carry Zecurit's real code-signing certificate, signature checks alone will not flag them.

Delivery: email link to a direct download or a lure page; URL paths such as /DocS/files/, /Ddcu/, /access/ and download_invitee.php; at least one installer was served from a Cloudflare R2 bucket (r2.dev).
Payload: Inno Setup installers that silently install a Zecurit MSI and run ZecuritAgentRegister.exe to enroll the agent, giving remote control, screen capture and command execution.
Host artifacts: C:\Program Files\Zecurit\, HKLM\SOFTWARE\Zecurit\Agent, ZecuritAgentService.exe, ZecuritAgentInstaller.msi, InstallUninstallApp.exe; traffic to app.zecurit[.]com and dms.zecurit[.]com.
Signer: ZECURIT TECHNOLOGIES PRIVATE LIMITED, SHA-1 thumbprint 6D9ED879ADC48C1B0EBA4058A5C6511A5DD07C63.
Sample SHA-256s: d7bae1209fea304403d8eb6f042ea0b9b84be14ef7e29ab9f9c9c079e8d1f1c7 (Docusign.exe), 24387787c0789f0b8ff02102273a8edef5888c420be15bfae103250ce7aa8b49 (documentpdf.exe), 8585921fd9bb23f8dcd12e0d637d43aee6597793038e1ac53dcbe18516024649 (Evite.exe), 65f1731d5cdcc169c36d3690196f3a7c60922d85c620d172cc607c8d7eb96566 (ViewDoc.exe).

Hunt: any Zecurit install or traffic where Zecurit is not an approved RMM; Inno Setup executables with document-style names launched from browser download folders; and new RMM service installs that follow an email link click.

Sources: Unit 42 timely threat intel: Phishing emails distribute Zecurit Agent RMM tool (Oct 29) · Unit 42 on X (Oct 30)