Executive Summary
A tech-support scam directing victims to install the commercially available remote-access application UltraViewer sent us down an unexpected trail. DNS and email analysis led us from UltraViewer to the bulk-mailing application UltraMailer, then to chanret[.]com, a tracking domain used in a long-running QuickBooks phishing campaign.
That campaign uses over 350 QuickBooks-lookalike domains and directs victims to call scammers who attempt to steal QuickBooks credentials. Its tracking pixels also expose recipient information to UltraMailer’s tracking service when phishing messages are opened.
UltraMailer, meanwhile, is openly promoted by users as a spamming tool on criminal forums. Its own documentation describes replacing private tracking domains when they become blocklisted, and online tutorials explicitly discuss its use for spam. We found no abuse-reporting mechanism on the UltraMailer website. When the same QuickBooks actor briefly moved to bulk-mail provider Mail250, Mail250 suspended the account after we reported the activity and the campaign stopped. The actor later returned to the UltraMailer-associated tracker, where the campaign continues.
The trail took another turn when we found trojanized installers containing authentic copies of both UltraMailer and UltraViewer. One malicious UltraMailer installer carried njRAT, potentially infecting people who downloaded this illegitimate version of the mailing software with a remote access trojan.
We found no evidence that the developers of UltraViewer or UltraMailer participated in these scams or distributed the malware described in this research. Rather, the findings demonstrate how threat actors can abuse widely available software for phishing, scams, and malware delivery, leaving defenders to distinguish normal use from abuse.
The remote access tool UltraViewer is widely used: on some days, we have observed connections to its primary domain from as many as 30% of our customers. This tool serves both as a low-cost management tool for legitimate organizations and as an initial access method for malicious actors. Organizations that do not have a business need for this software should consider restricting access to prevent unauthorized access to their systems.
Where the Ultra Trail Began
We’d seen UltraViewer before. It appeared in our recent investigation of Help TDS, which directs users to tech-support scam call centers. In that case, the fake Microsoft support agent urged us to download UltraViewer to give them access to our computer. We investigated UltraViewer itself to understand why the threat actor was deploying this particular software. UltraViewer led us to UltraMailer.
From the official website of the UltraViewer application, ultraviewer[.]net, we identified the registrant email, and identified several other domains registered with the same email address, including ultramailer[.]org and chanret[.]com. The purpose of the ultramailer[.]org domain was immediately clear: it was the host of “UltraMailer – Bulk Email Software.” Chanret[.]com was less obvious. So, we went hunting in our spam collection.
We discovered a phishing campaign impersonating QuickBooks support, operated by a threat actor controlling over 350 QuickBooks-lookalike domains. Most of these domains were registered with Dynadot during a single week, from June 29 to July 5, 2026. The emails use chanret[.]com to host a tracking pixel that records when a recipient opens the message and identifies the recipient. Each email includes this 1×1 tracking pixel, which fires a GET request to track.chanret[.]com upon the opening of the email. The URL path encodes two identifiers: a campaign directory, believed to map to an UltraMailer customer or send batch, and the recipient’s email address base64-encoded as the image filename.
<img src=”http://track.chanret.com/images/4x406rtk5/ZW1haWxAZXhhbXBsZS5jb20.jpg” height=”1″ width=”1″>
In this example, 4x406rtk5 is the campaign directory and ZW1haWxAZXhhbXBsZS5jb20 decodes to email@example.com (replaced here with a placeholder; the originals contain the actual recipient address).
The phishing emails instruct recipients to call a supposedly toll-free number, but the numbers we observed used the 805 area code. Two numbers observed in this campaign are +1 (805) 835-8090 and +1 (805) 699-1139. See Figure 1.
Figure 1. Screenshot of a truncated image of a phishing email sent with the embedded chanret[.]com tracking pixel
We learned that chanret[.]com operates as the default domain for tracking emails sent by UltraMailer. This does not mean UltraMailer’s developers sent the phishing emails. It does show that the QuickBooks scammers use UltraMailer and that tracking data is sent through chanret[.]com. Figure 2 shows a “trail map” of our investigation.
Figure 2. A “trail map” of our investigation into UltraViewer and UltraMailer, and the malware and phishing we found along the way
A Brief Detour to Mail250
In August 2026, the actor that we were tracking changed infrastructure. They shifted from using chanret[.]com as a tracker to smtracking[.]qbcares[.]com, which was configured to use a CNAME to smtracking[.]healthclub951[.]swp23[.]com. The second-level domain, swp23[.]com, is attributed to another bulk mailing service, Mail250.
We reached out to Mail250 on August 25, 2026, using their abuse reporting system, and Mail250 promptly responded. They stated that they suspended the user, and we verified that the campaign stopped following that suspension.
The detour was short-lived. On September 8, the actor returned to chanret[.]com and resumed the QuickBooks campaign. Notably, UltraMailer does not have an abuse reporting mechanism on their website.
Built for Bulk, Popular with Spammers
UltraMailer’s own documentation uses language that can be interpreted as associated with spam operations. For example, they provide instructions on how to avoid blocks to the emails that are sent with the application (the wording on their site, as of this writing):
“The great think [sic] is UltraMailer can changeable [sic] the tracking domain to your private domain so you won’t need to worry. Which mean when your domain is listed in blacklist, you can also change it again and every email will go to inbox again.”
Figure 3 below shows an excerpt of UltraMailer’s instructions for setting up a sub-domain that will be associated with chanret[.]com for tracking.
Figure 3. Screenshot of UltraMailer instructions that associate chanret[.]com with the tracking capabilities of UltraMailer. After following the instructions, the tracking information is still sent to track[.]chanret[.]com.
UltraMailer is not difficult to find in the criminal underground. Forum posts advertising the software and spamming courses, under titles such as “UltraMailer – Best Spamming Tool In The Market,” appear across clearnet hacking forums including sinister[.]li and patched[.]to, as well as on BreachForums and multiple Russian-language dark web platforms, making it a widely adopted tool within spam and phishing operations.
When the Mailer Comes with Malware
Then the investigation took an ironic turn: we found a trojanized copy of UltraMailer. The file, UltraMailer_setup_v3.6_en.exe (SHA-256: 9e1a679ca45a149d2bd681cbb8ec3b1cc3d271fad51b092a3db5e5642eb6676b), contains an embedded njRAT payload. At the time of our analysis, 45 of 75 vendors on VirusTotal detected it as malicious. This trojanized installer is unsigned but contains an authentic copy of Ultramailer with a DUC FABULOUS CO.,LTD Sectigo certificate (936BB9B6A2F8E1CD149B33F4A16D8A927CD675DE). In other words, spammers looking for UltraMailer may have ended up getting infected with a remote access trojan.
The ultraviewer[.]net and ultramailer[.]org webpages share a contact in Vietnam, “DUCFABULOUS RESEARCH & DEVELOPMENT SCIENCE, SOFTWARE TECHNOLOGY & MANUFACTURING LTD.” It was this corporate identity that led us to the connection made by Hexastrike, between this organization and a Chinese APT referred to as “Silver Fox.”
UltraViewer Inside the Malware
Research published by Hexastrike connected DUC FABULOUS CO.,LTD with activity they attributed to the threat actor Silver Fox. In Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installers, Hexastrike reported that the samples carried “a stolen valid Extended Validation code-signing certificate issued by SSL.com to DUC FABULOUS CO.,LTD.” We could not independently corroborate that the certificate’s private key was stolen or compromised. The installation files we examined are unsigned. They contain a copy of UltraViewer that is itself signed with the “DUC FABULOUS CO.,LTD” certificate with SHA1 thumbprint 2C1D12F8BBE0827400A8440AF74FFFA8DCC8097C.
Whatever the explanation for the certificate, Hexastrike’s research led us to additional malicious samples containing UltraViewer. One recent example is a trojanized UltraViewer installer, UltraViewer_setup_6.6.133_vi.exe (SHA-256: 28f046d9f985e58cbc8b245b54d4179feacecc12f41e2f6594306867ce3e8727), that was submitted to VirusTotal on September 4, 2026, detected as malicious by 60 of 76 vendors and attributed to the Win32.Comet.A family, also known as DarkKometa. The sample installs itself under C:\ProgramData\Synaptics\Synaptics.exe, impersonating the Synaptics touchpad driver to avoid detection. Like the malware above, the installer is unsigned, but it contains a valid certificate for the authentic UltraViewer application bundled within it.
Abused, but Accountable?
None of our findings implicate the developers of UltraViewer and UltraMailer in the scams or malware distribution described here. What the research does show is persistent criminal abuse of both applications. The distinction matters because free and low-cost software can become valuable infrastructure for threat actors without its developer participating in the crime. The response to that abuse differs between providers. Mail250 suspended the account we reported, and the observed campaign stopped. We found no comparable abuse-reporting mechanism on the UltraMailer website.
Public complaints also document scammers directing victims to UltraViewer. UltraViewer itself appears to recognize the problem: its website includes a “Report Scam” link at the bottom of the landing page, shown in Figure 4.
Figure 4. Screenshot of the bottom of the ultraviewer[.]net landing page that contains a “Report scam” link
In response to one complaint on Trustpilot in 2023, the representative of UltraViewer stated: “We genuinely sympathize with your concern about vulnerable individuals, particularly seniors, falling victim to these scams. Rest assured, we are working tirelessly to enhance our security measures and raise awareness among our users to protect themselves from potential threats.”
QuickBooks Lookalike Example
qbcares[.]com
Malware Indicators
28f046d9f985e58cbc8b245b54d4179feacecc12f41e2f6594306867ce3e8727
9e1a679ca45a149d2bd681cbb8ec3b1cc3d271fad51b092a3db5e5642eb6676b
Call Center Phone Numbers Observed
(805) 835-8090
(805) 699-1139
