RatPressto Phish Kit

Fortra Intelligence and Research Experts (FIRE) have discovered an active phishing campaign leveraging a reusable Adobe-themed phishing kit deployed across multiple compromised WordPress websites. Threat actors have been using the kit to distribute remote access tooling, primarily ScreenConnect, through staged social engineering workflows designed to mimic legitimate Adobe Document Cloud delivery notifications. 

FIRE have dubbed this phish kit RatPressto, because the kit is hosted on WordPress sites and pushes a screen-connect based remote access trojan (RAT) via a hidden iframe, as if by magic. 

RatPressto has been observed targeting financial organizations, looking to silently exfiltrate credentials, secrets, and sensitive data that could be used to aid further compromise. 

Analysis confirms that the phishing infrastructure is highly standardized across deployments. Multiple compromised websites were observed hosting byte-identical phishing pages with only victim-specific filenames modified between campaigns. The operation uses legitimate services such as GitHub for payload staging and ScreenConnect for remote access, significantly reducing detection rates by blending malicious activity into normal enterprise traffic. 

A notable operational pattern identified during the investigation is that several compromised WordPress environments exposed administrative functionality publicly through accessible wp-admin interfaces. This strongly suggests weak administrative security practices or previously compromised administrator credentials were leveraged to deploy the phishing kit. 

The RatPressto phishing kit operates as a two-stage delivery framework: 

1. A fake Adobe document delivery confirmation page persuades the victim that a secure file has already been downloaded. 

2. A hidden iframe silently downloads the payload in the background while the victim is instructed to open the file manually. 

The campaign demonstrates a mature operational structure including: 

• Reusable phishing kit infrastructure 

• Victim-specific payload naming 

• Use of legitimate signed binaries 

• Self-hosted command-and-control infrastructure 

• Cloudflare telemetry integration 

• Multi-domain deployment capability 

• Social engineering customization based on target context 

Fortra intelligence and research experts (FIRE) have identified a new private phishing kit being used to impersonate and target large corporations. The RatPressto phishkit was discovered in an investigation following the identification of several phishing emails impersonating legitimate or fake corporative emails.  

The emails directed victims toward compromised WordPress websites hosting a staged phishing kit designed to deliver ScreenConnect-based remote access malware. The malware can be categorised as a remote access trojan (or RAT) and is primarily used to exfiltrate sensitive data that can aid further compromise, potentially operating as an infostealer. 

Unlike traditional phishing campaigns that rely solely on malicious attachments, this operation uses a multi-stage web-based delivery framework hosted on legitimate but compromised websites. The threat actor combines social engineering, infrastructure reuse, and trusted enterprise software abuse to maximize infection success while minimizing detection. 

The analysis focused on: 

• WordPress-hosted phishing kit deployments 

• HTML and PHP source code reuse 

• Infrastructure overlap 

• Payload delivery mechanisms 

• Command-and-control evolution 

• ScreenConnect abuse 

• GitHub staging infrastructure 

• Victim deception techniques 

• Operational fingerprints 

The investigation identified several strong forensic indicators linking all deployments to a single private phishing kit. 

First, lets go over the attack flow of the RatPressto kit, we’ll then take a deeper dive into some of the artifacts and indicators and what that can tell us about the active campaign. 

Email Template Analysis