A criminal service is hiding behind a website that appears to offer Adobe Acrobat Reader. The site, acrobatreaderonline.com, is not a document service. Instead, it appears to expose an operator panel for building and managing attacks against Windows users.

The campaign uses a familiar trick: a trusted-looking document or payment theme leads a target toward a harmful download.

Earlier activity tied to the same infrastructure used a Windows batch, or .bat, file through a WebDAV remote folder, turning a PDF or boleto lure into a possible malware entry point.

Researchers at Clandestine identified the operation during an open-source review on August 23, finding a live malware-as-a-service, or MaaS, panel behind the Adobe-themed domain.

Clandestine said in a report shared with Cyber Security News (CSN) that the site was not an Adobe reader portal and should not be treated as safe.

https://t.co/LaGothWxgV is not Adobe Acrobat Reader Online.
Open-source review on 23 August 2026 shows a live malware-as-a-service panel behind an Adobe-themed domain. The page title is SecureWorkspace WebPanel; /api/ renders as Kaido Panel. The stack is Vite/React, Tailwind… pic.twitter.com/arJGRFqXto
— Clandestine (@akaclandestine) August 23, 2026

The discovery shows how a convincing brand imitation can move from a phishing lure to a working criminal platform. It contains features for collecting victim data, managing files and preparing malware modules, lowering the barrier for operators.

New Malware-as-a-service Leveraging Adobe-themed Domain

The domain creates a serious trust problem for people searching for a PDF reader, opening document links or responding to payment messages.

Its public page uses the title “SecureWorkspace WebPanel,” while an application route identifies itself as “Kaido Panel.” Neither is a legitimate document viewer or cloud document service.

Behind the landing page, researchers found protected endpoints for a command-and-control interface and a live SignalR communication hub.

Unauthenticated requests returned a bearer-authentication challenge, showing the site is more than a static decoy. It is designed to give authorized operators access to backend functions.

Public JavaScript exposed references to a builder, file manager, authentication refresh function and a section labelled loot. The code listed modules connected with information theft, banking overlays, PIX payments and boleto lures.

That mix makes the operation relevant to Windows users and organizations processing financial documents. The documented delivery chain shows why a file extension can matter as much as a document name.

Historical sandbox records linked Kaido infrastructure to a WebDAV loader using a .bat dropper and the Windows WebClient service. Similar Windows File Explorer WebDAV abuse can open remote content in ways that appear less suspicious than a conventional download.

A batch file can run commands when a victim opens it, so it should never be assumed to be a harmless document. Users should question supposed PDF files with unusual extensions, shortcuts or download prompts.

Recent fake Adobe document campaigns have likewise used familiar sharing language to persuade recipients to run unwanted software.

Infrastructure and Defensive Actions

The domain was registered in June 2026 and uses Cloudflare-hosted infrastructure. Its nameservers match those used by kaido.sh, a related domain seen earlier.

At the time of review, only the www host resolved; several likely service names did not. A future address assigned to those names may signal a command-and-control shift.

This justifies immediate checks. Organizations should block the identified domains across DNS, web proxies and email controls, then examine logs for requests to them.

Teams should look for unexpected WebClient activity and the listed local cache artifact, which can reveal WebDAV-based delivery.

Users should download Acrobat Reader only from Adobe’s official domain, not lookalike sites or unsolicited links. Security teams should avoid logging into the panel or executing files obtained from it.

The risk fits a pattern seen in malware disguised as trusted apps, where recognizable names weaken a user’s caution. For defenders, combine domain blocking with alerts for suspicious remote-folder connections and script launches.

Preserve relevant telemetry before action, check whether artifacts appear on endpoints, and report the infrastructure to the registrar, hosting provider and national response teams.

A Windows AllaKore malware operation illustrates how PDF lures, WebDAV and batch scripts can form a multi-stage Windows compromise.

Indicators of comrpomise (IoCs):-

Type	Indicator	Description
Domain	acrobatreaderonline[.]com	Adobe-themed domain hosting the suspected MaaS panel
Domain	www.acrobatreaderonline[.]com	The only resolving host noted during the review
Domain	kaido[.]sh	Related domain sharing the same nameserver pair
Domain	free.kaido[.]sh	Historical WebDAV loader host, reported as NXDOMAIN at review time
Wildcard domain	.kaido[.]sh	Domain cluster recommended for blocking
Domain	x4m1k[.]com	Domain included in the source blocklist
IP address	104.21.2[.]104	Anycast address associated with the Adobe-themed domain
IP address	172.67.129[.]21	Anycast address associated with the Adobe-themed domain
IP address	185.208.158[.]27	Historical IP address tied to the WebDAV loader activity
Nameserver	aarav.ns.cloudflare[.]com	Nameserver shared by the observed domains
Nameserver	may.ns.cloudflare[.]com	Nameserver shared by the observed domains
URL path	/hub	Protected SignalR hub endpoint
URL path	/api/loot/	Protected endpoint associated with collected data
URL path	/api/auth/refresh	Public JavaScript reference to an authentication-refresh route
File artifact	.bat	Batch-file dropper used in historical activity
Directory artifact	TfsStore\Tfs_DAV	Windows cache artifact associated with the WebDAV loader
Session artifact	kaido_token	Session-related artifact exposed in public JavaScript
Windows service	WebClient	Windows component relevant to the reported WebDAV delivery chain

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post New Malware-as-a-service Leveraging Adobe-themed Domain to Attack Windows Users Using .bat File appeared first on Cyber Security News.