A phishing campaign uses fake invoices to install the legitimate Action1 remote-management agent under attacker control, giving persistent access to compromised PCs. GajIPS detects key stages of the attack
Severity: HIGH · Priority: P2 — RMM tool abuse via fake-invoice phishing, investigate on hit
These rules cover a complete kill chain, in which threat actors distribute phishing emails carrying a fake PDF invoice. When the PDF is opened, an embedded OpenActiontag automatically redirects the victim's browser to download a VBScript hosted on a Vercel deployment (up-theta-rose.vercel.app/adobe_new_update.vbs). The VBScript displays a decoy PDF to keep the victim calm, then downloads and silently installs the Action1 Remote Management and Monitoring agent as a Windows service named A1Agent. The agent is a legitimately signed, real Action1 binary, but registered to a customer account (49b18106-681d-456a-b098-092e2818c09a) controlled by the attacker rather than the victim's organisation. This gives the attacker full, persistent remote access through Action1's own legitimate cloud infrastructure — a technique that bypasses most network-based detection because all traffic goes to genuine Action1 servers over HTTPS.
A second wave in the same campaign uses a ZIP file containing an HTA to deliver the agent from a second Vercel host (update-two-tau.vercel.app). The broader CSuite phishing operation documented by Xcitium places this Action1 abuse in a wider context: the same operation also delivers ScreenConnect, Atera, and Syncro agents renamed to Adobe or DocuSign packages, and sometimes steals Microsoft 365 session cookies alongside installing the RMM.
A hit on the Customer ID rule or the non-Action1-host MSI rule is a confirmed RMM abuse event. Identify the affected device, check for the service A1Agent (action1_agent.exe) and the registry key HKLM\Software\Action1\Agent, and remove both. Any credentials or data the attacker could access through the remote session should be treated as exposed. Because legitimate Action1 connections cannot be distinguished from attacker-controlled ones by destination alone, only a Customer ID check (the registry key above) or an authorised-deployment inventory confirms or clears a device. A hit on the PDF OpenAction rules indicates a phishing email is being delivered and a user may have clicked. Report the sending address to Action1 (abuse@action1.com) so the attacker's free tenant can be revoked.