Phishing campaign plants Action1 remote-management agent through fake PDF invoices

The link is inside the PDF. Mertens, a senior handler at the SANS Internet Storm Center, found "OpenAction" and "URI" keywords in the attachment, with a page-sized link annotation behind them ^[1][2]. "This is a common trick to avoid writing URLs in email bodies that can be easily detected," he wrote ^[3]. We'd expect mail filters that score URLs in the message body to let these emails through.

The payload makes no attempt to evade antivirus. The MSI holds four files, among them action1_remote_exe and main_service_exe, and VirusTotal reported none of them as malicious ^[6]. They are Action1's own binaries, signed with an "Action1 Corporation" certificate that expired in May 2026 ^[7]. The agent persists as a service named A1Agent that runs `C:\Windows\Action1\action1_agent.exe` ^[8]. Its configuration sits under `HKLM\Software\Action1\Agent`, in values named CustomerId, Certificate, PrivateKey, MSI and INSTALLDIR ^[9].

"We are facing here the same behaviour: the threat actor abuse the cloud infrastructure of the company developing the RMM tool, probably using a free/test account," Mertens wrote ^[11]. The trial account is his assessment, and he hedges it with "probably" ^[11].

We think this is cheap to stop at an organisation that does not use Action1. There, an A1Agent service, a `C:\Windows\Action1` directory or a connection to server[.]na-2.action1[.]com counts as a finding with no other evidence needed ^[8][10]. Both payload hosts in the diary were vercel.app subdomains ^[13].

Mertens opened the diary with "It seems that a trend started" ^[15]. In our view the operator can swap the script wrapper and the RMM brand freely, since the HTA variant still ended at the identical MSI ^[12]. The diary does not name an actor or say whether the VBS runs without a further click from the victim.