---
title: Hunt: phishing lures named Docusign.exe, documentpdf.exe, Evite.exe and ViewDoc.exe install a legitimately signed Zecurit Agent RMM enrolled to the attacker | ctxsec
url: https://ctxsec.com/items/hunt-unit42-zecurit-agent-rmm-phishing-docusign-evite-lures
description: ""
status: "vendor threat intel (Palo Alto Networks Unit 42 timely threat intel, Oct 29-30); legitimate signed RMM abused"
published: 2026-10-30
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-unit42-zecurit-agent-rmm-phishing-docusign-evite-lures.md)

vendor threat intel (Palo Alto Networks Unit 42 timely threat intel, Oct 29-30); legitimate signed RMM abused

2026-10-30

### Hunt: phishing lures named Docusign.exe, documentpdf.exe, Evite.exe and ViewDoc.exe install a legitimately signed Zecurit Agent RMM enrolled to the attacker

Unit 42 reports an ongoing phishing campaign posing as document-sharing notices and event invitations that installs **Zecurit Agent**, a commercial remote monitoring and management tool, configured by the attacker. Because the installers carry Zecurit's real code-signing certificate, signature checks alone will not flag them.

- **Delivery:** email link to a direct download or a lure page; URL paths such as `/DocS/files/`, `/Ddcu/`, `/access/` and `download_invitee.php`; at least one installer was served from a Cloudflare R2 bucket (`r2.dev`).
- **Payload:** Inno Setup installers that silently install a Zecurit MSI and run `ZecuritAgentRegister.exe` to enroll the agent, giving remote control, screen capture and command execution.
- **Host artifacts:** `C:\Program Files\Zecurit\`, `HKLM\SOFTWARE\Zecurit\Agent`, `ZecuritAgentService.exe`, `ZecuritAgentInstaller.msi`, `InstallUninstallApp.exe`; traffic to app.zecurit[.]com and dms.zecurit[.]com.
- **Signer:** ZECURIT TECHNOLOGIES PRIVATE LIMITED, SHA-1 thumbprint 6D9ED879ADC48C1B0EBA4058A5C6511A5DD07C63.
- **Sample SHA-256s:** d7bae1209fea304403d8eb6f042ea0b9b84be14ef7e29ab9f9c9c079e8d1f1c7 (Docusign.exe), 24387787c0789f0b8ff02102273a8edef5888c420be15bfae103250ce7aa8b49 (documentpdf.exe), 8585921fd9bb23f8dcd12e0d637d43aee6597793038e1ac53dcbe18516024649 (Evite.exe), 65f1731d5cdcc169c36d3690196f3a7c60922d85c620d172cc607c8d7eb96566 (ViewDoc.exe).

**Hunt:** any Zecurit install or traffic where Zecurit is not an approved RMM; Inno Setup executables with document-style names launched from browser download folders; and new RMM service installs that follow an email link click.

Sources: [Unit 42 timely threat intel: Phishing emails distribute Zecurit Agent RMM tool (Oct 29)](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-29-Phishing-emails-push-Zecurit-Agent-RMM.txt) · [Unit 42 on X (Oct 30)](https://x.com/Unit42_Intel/status/2116265918867070977)