Kaido Panel MaaS Leverages Adobe Theme to Distribute Malware
A new Malware-as-a-Service (MaaS) operation, dubbed 'Kaido Panel,' is targeting Windows users through a deceptive Adobe-themed domain impersonating Adobe Acrobat Reader.
A sophisticated Malware-as-a-Service (MaaS) operation, identified as 'Kaido Panel,' has been discovered by researchers, leveraging a convincing impersonation of Adobe Acrobat Reader to lure unsuspecting Windows users. The malicious service operates from a domain, acrobatreaderonline.com, which falsely presents itself as a legitimate Adobe download portal. Instead, it hosts an operator panel designed to facilitate the creation and management of cyberattacks, including the collection of victim data and the preparation of various malware modules.
Researchers at Clandestine uncovered the live MaaS panel on August 23, 2026, noting that the site's public-facing title is "SecureWorkspace WebPanel," while an internal API route reveals its true identity as "Kaido Panel." The underlying technology stack includes Vite/React and Tailwind, suggesting a modern web application framework. Behind the deceptive landing page, protected endpoints for command-and-control (C2) functions and a SignalR communication hub were identified, indicating a fully functional, albeit illicit, platform.
The Kaido Panel's interface is designed to lower the barrier to entry for cybercriminals, offering features for data collection, file management, and malware module preparation. Publicly exposed JavaScript code references specific functionalities such as a builder, file manager, authentication refresh, and a "loot" section, strongly implying capabilities for information theft, banking fraud, and the creation of lures for payment systems like PIX and boleto.
Historical analysis of the infrastructure linked to Kaido Panel reveals past activity involving a Windows batch (.bat) file dropper delivered via a WebDAV remote folder. This method, often disguised as a PDF or payment document, exploits the Windows WebClient service to execute malicious payloads. The use of WebDAV can make the delivery mechanism appear less suspicious than a traditional file download, further increasing the risk to users who might open seemingly innocuous files.
The domain was registered in June 2026 and is currently hosted behind Cloudflare, with its nameservers matching those of a previously observed related domain, kaido.sh. While only the 'www' host was resolving at the time of discovery, other potential service names may indicate future shifts in the C2 infrastructure. Organizations are advised to block the identified domains and related infrastructure across their networks.
Defensive measures include blocking the identified domains at the DNS and web proxy levels, and monitoring network logs for suspicious activity related to WebClient service usage or unusual remote folder connections. Users are strongly cautioned to download Adobe Acrobat Reader exclusively from Adobe's official website and to exercise extreme vigilance regarding unsolicited links or files, especially those with unusual extensions or download prompts.
The Kaido Panel operation exemplifies a growing trend of Malware-as-a-Service platforms that exploit brand impersonation and sophisticated delivery techniques to target Windows users. The combination of a convincing lure, a feature-rich operator panel, and historically observed WebDAV abuse highlights the evolving threat landscape and the need for robust endpoint security and user awareness training.
Indicators of Compromise (IoCs) provided include domains such as acrobatreaderonline[.]com and kaido[.]sh, associated IP addresses, nameservers, and specific URL paths related to the panel's functionality. The inclusion of a .bat file artifact and a Windows cache artifact associated with WebDAV further aids in detection and forensic analysis.