CSuite phishing kit
CSuite is a fake Adobe document page that reports each visitor to Telegram and pushes an MSI installer. We have matched it on 33 sites since 1 September.
CSuite in numbers
Since 1 September, the first CSuite match in our records, counted on 13 October 2026. How we count.
| Sites with CSuite code | 33 |
|---|---|
| Sites with a match in the last 30 days | 26 |
| New sites in September | 22 |
| Sites captured since 25 September | 19 |
ANY.RUN tracks the operation as CSuite
ANY.RUN tracks this operation as CSuite. Its fake Adobe document page fingerprints the browser, geolocates the visitor and sends the record to Telegram with the title Adobe Acrobat MSI Download Page Visit.
The document page starts the installer download
The page presents itself as a PDF reader download. Once the document is ready, its script creates a temporary link for an MSI installer, gives the link a download attribute, starts it and removes the element from the page.
The Telegram bot and channel change between copies. The visit title and the download sequence do not.
What we see
| Month | New sites |
|---|---|
| September | 22 |
| October so far | 11 |
Among successful captures since 25 September, 0 of 19 CSuite sites ran WordPress.
Checking a CSuite page
Preserve the first response and the network log. Look for:
- a fake Adobe or PDF reader page that starts an MSI download
- browser fingerprinting and geolocation before the download
Adobe Acrobat MSI Download Page Visitin a Telegram message- a request to the Telegram Bot API with a channel ID
- a temporary anchor with a
downloadattribute that is removed after use
Remove the page, installer and Telegram configuration. Review hosting, DNS and deployment access and rotate their credentials.