A newly discovered malware-as-a-service (MaaS) operation is using a convincing fake Adobe Acrobat Reader website to push information-stealing and banking-fraud malware onto Windows machines, according to research shared with Cyber Security News by the analyst known as Clandestine. The platform, internally identified as “SecureWorkspace WebPanel” and built on a backend dubbed “Kaido Panel,” gives even low-skilled operators a point-and-click way to launch financially motivated attacks.

A Trusted Brand as Bait

The campaign’s front door is acrobatreaderonline.com, a domain registered in June 2026 that closely mimics Adobe’s real download pages. Because Adobe Acrobat Reader is one of the most widely trusted and widely installed pieces of software in the world, a lookalike site immediately lowers a victim’s guard. Targets typically arrive at the page through document lures, including fake PDFs and boleto-style payment forms, that are crafted to look like ordinary paperwork rather than a security threat.

The WebDAV and Batch File Trick

Rather than serving a conventional executable download, which browsers and endpoint tools are increasingly good at flagging, the operation abuses Windows’ built-in WebDAV client. By pointing victims at a remote WebDAV folder, the attackers can make malicious content appear inside Windows File Explorer in a way that looks far less suspicious than a typical download prompt. From there, a .bat (batch script) file does the actual dirty work.

Batch files still carry an outdated reputation as harmless text-based scripts, but in Windows they can execute arbitrary system commands with the same privileges as the user who opens them. In this campaign, the batch file quietly triggers the next stage of the infection chain once a victim opens what appears to be a routine document.

What the Malware Actually Does

Once installed, the payload is built around financial theft. According to the researcher’s analysis, the panel’s backend includes dedicated modules for general information stealing, banking overlay attacks that intercept login credentials on financial sites, and fraud aimed specifically at Brazil’s PIX instant-payment system and boleto payment slips. That regional focus suggests the operators are primarily targeting Brazilian and broader Latin American users, though the underlying platform could be pointed at other regions just as easily.

The control panel itself is built with modern web technology (Vite, React, and Tailwind CSS) and is gated behind bearer-token authentication, with a “loot” section for reviewing stolen data and a SignalR-based communication hub for real-time command and control. In other words, this isn’t a hobbyist tool: it’s built with the same engineering discipline as a legitimate SaaS product, just repurposed for crime.

Infrastructure and Indicators

Investigators linked the primary domain to a wider cluster of infrastructure sharing the same Cloudflare nameservers, including kaido.sh and its subdomains, which previously hosted a WebDAV-based loader. Known indicators associated with the campaign include:

• Domains: acrobatreaderonline[.]com, kaido[.]sh, free.kaido[.]sh, x4m1k[.]com
• IP addresses: 104.21.2[.]104, 172.67.129[.]21, and 185.208.158[.]27
• A Windows WebDAV cache artifact left in the TfsStore\Tfs\_DAV directory
• Use of the Windows WebClient service and a session identifier referenced as “kaido_token”

Why This Matters

The campaign is a reminder that brand impersonation and living-off-the-land techniques remain far more effective than exotic zero-days for most attackers. Combining a trusted software brand with a native Windows feature like WebDAV lets criminals sidestep many of the download warnings that browsers and antivirus tools have gotten better at catching, while a batch file dropper exploits the lingering assumption that scripts are less dangerous than .exe files.

Recommendations for Defenders

• Block the known domains and IP addresses at the DNS, proxy, and email gateway level, and review logs for any historical connections to them.
• Monitor endpoints for unexpected WebClient service activity and for the TfsStore cache artifact described above.
• Remind users to download Acrobat Reader only from adobe.com, and to treat unsolicited document links, especially ones tied to payments, with suspicion.
• Watch for unusual outbound connections to remote WebDAV shares, which are rarely used in normal business workflows.
• Preserve relevant logs before remediating an infected machine, since MaaS operators frequently reuse infrastructure across multiple victims.

As MaaS platforms like this one continue to lower the technical bar for financially motivated cybercrime, organizations that process payments or handle sensitive financial documents should treat brand-impersonation domains as a standing threat rather than a one-off incident.