That campaign uses over 350 QuickBooks-lookalike domains and directs victims to call scammers who attempt to steal QuickBooks credentials. Its tracking pixels also expose recipient information to UltraMailer\u2019s tracking service when phishing messages are opened.<\/p>\n
UltraMailer, meanwhile, is openly promoted by users as a spamming tool on criminal forums. Its own documentation describes replacing private tracking domains when they become blocklisted, and online tutorials explicitly discuss its use for spam. We found no abuse-reporting mechanism on the UltraMailer website. When the same QuickBooks actor briefly moved to bulk-mail provider Mail250, Mail250 suspended the account after we reported the activity and the campaign stopped. The actor later returned to the UltraMailer-associated tracker, where the campaign continues.<\/p>\n
The trail took another turn when we found trojanized installers containing authentic copies of both UltraMailer and UltraViewer. One malicious UltraMailer installer carried njRAT, potentially infecting people who downloaded this illegitimate version of the mailing software with a remote access trojan.<\/p>\n
We found no evidence that the developers of UltraViewer or UltraMailer participated in these scams or distributed the malware described in this research. Rather, the findings demonstrate how threat actors can abuse widely available software for phishing, scams, and malware delivery, leaving defenders to distinguish normal use from abuse.<\/p>\n
The remote access tool UltraViewer is widely used: on some days, we have observed connections to its primary domain from as many as 30% of our customers. This tool serves both as a low-cost management tool for legitimate organizations and as an initial access method for malicious actors. Organizations that do not have a business need for this software should consider restricting access to prevent unauthorized access to their systems.<\/p>\n
Where the Ultra Trail Began<\/h3>\n
We’d seen UltraViewer before. It appeared in our recent investigation of Help TDS<\/strong><\/a>, which directs users to tech-support scam call centers. In that case, the fake Microsoft support agent urged us to download UltraViewer to give them access to our computer. We investigated UltraViewer itself to understand why the threat actor was deploying this particular software. UltraViewer led us to UltraMailer.<\/p>\n From the official website of the UltraViewer application, ultraviewer[.]net, we identified the registrant email, and identified several other domains registered with the same email address, including ultramailer[.]org and chanret[.]com. The purpose of the ultramailer[.]org domain was immediately clear: it was the host of \u201cUltraMailer – Bulk Email Software.\u201d Chanret[.]com was less obvious. So, we went hunting in our spam collection.<\/p>\n We discovered a phishing campaign impersonating QuickBooks support, operated by a threat actor controlling over 350 QuickBooks-lookalike domains. Most of these domains were registered with Dynadot during a single week, from June 29 to July 5, 2026. The emails use chanret[.]com to host a tracking pixel that records when a recipient opens the message and identifies the recipient. Each email includes this 1\u00d71 tracking pixel, which fires a GET request to track.chanret[.]com upon the opening of the email. The URL path encodes two identifiers: a campaign directory, believed to map to an UltraMailer customer or send batch, and the recipient’s email address base64-encoded as the image filename.<\/p>\n <img src=”http:\/\/track.chanret.com\/images\/4x406rtk5\/ZW1haWxAZXhhbXBsZS5jb20.jpg” height=”1″ width=”1″><\/em><\/p>\n In this example, 4x406rtk5 is the campaign directory and ZW1haWxAZXhhbXBsZS5jb20 decodes to email@example.com (replaced here with a placeholder; the originals contain the actual recipient address).<\/p>\n The phishing emails instruct recipients to call a supposedly toll-free number, but the numbers we observed used the 805 area code. Two numbers observed in this campaign are +1 (805) 835-8090 and +1 (805) 699-1139. See Figure 1.<\/p>\n Figure 1. Screenshot of a truncated image of a phishing email sent with the embedded chanret[.]com tracking pixel<\/p>\n We learned that chanret[.]com operates as the default domain for tracking emails sent by UltraMailer. This does not mean UltraMailer\u2019s developers sent the phishing emails. It does show that the QuickBooks scammers use UltraMailer and that tracking data is sent through chanret[.]com. Figure 2 shows a \u201ctrail map\u201d of our investigation.<\/p>\n Figure 2. A \u201ctrail map\u201d of our investigation into UltraViewer and UltraMailer, and the malware and phishing we found along the way<\/p>\n In August 2026, the actor that we were tracking changed infrastructure. They shifted from using chanret[.]com as a tracker to smtracking[.]qbcares[.]com, which was configured to use a CNAME to smtracking[.]healthclub951[.]swp23[.]com. The second-level domain, swp23[.]com, is attributed to another bulk mailing service, Mail250.<\/p>\n We reached out to Mail250 on August 25, 2026, using their abuse reporting system, and Mail250 promptly responded. They stated that they suspended the user, and we verified that the campaign stopped following that suspension.<\/p>\n The detour was short-lived. On September 8, the actor returned to chanret[.]com and resumed the QuickBooks campaign. Notably, UltraMailer does not have an abuse reporting mechanism on their website.<\/p>\n UltraMailer\u2019s own documentation uses language that can be interpreted as associated with spam operations. For example, they provide instructions on how to avoid blocks to the emails that are sent with the application (the wording on their site, as of this writing<\/strong><\/a>):<\/p>\n \u201cThe great think [sic] is UltraMailer can changeable [sic] the tracking domain to your private domain so you won’t need to worry. Which mean when your domain is listed in blacklist, you can also change it again and every email will go to inbox again.\u201d<\/em><\/p>\n Figure 3 below shows an excerpt of UltraMailer\u2019s instructions for setting up a sub-domain that will be associated with chanret[.]com for tracking.<\/p>\n Figure 3. Screenshot of UltraMailer instructions that associate chanret[.]com with the tracking capabilities of UltraMailer. After following the instructions, the tracking information is still sent to track[.]chanret[.]com.<\/p>\n UltraMailer is not difficult to find in the criminal underground. Forum posts advertising the software and spamming courses, under titles such as \u201cUltraMailer – Best Spamming Tool In The Market,\u201d appear across clearnet hacking forums including sinister[.]li and patched[.]to, as well as on BreachForums and multiple Russian-language dark web platforms, making it a widely adopted tool within spam and phishing operations.<\/p>\n Then the investigation took an ironic turn: we found a trojanized copy of UltraMailer. The file, UltraMailer_setup_v3.6_en.exe (SHA-256: 9e1a679ca45a149d2bd681cbb8ec3b1cc3d271fad51b092a3db5e5642eb6676b<\/strong><\/a>), contains an embedded njRAT payload. At the time of our analysis, 45 of 75 vendors on VirusTotal detected it as malicious. This trojanized installer is unsigned but contains an authentic copy of Ultramailer with a DUC FABULOUS CO.,LTD Sectigo certificate (936BB9B6A2F8E1CD149B33F4A16D8A927CD675DE). In other words, spammers looking for UltraMailer may have ended up getting infected with a remote access trojan.<\/p>\n The ultraviewer[.]net and ultramailer[.]org webpages share a contact in Vietnam, \u201cDUCFABULOUS RESEARCH & DEVELOPMENT SCIENCE, SOFTWARE TECHNOLOGY & MANUFACTURING LTD.\u201d It was this corporate identity that led us to the connection made by Hexastrike, between this organization and a Chinese APT referred to as \u201cSilver Fox.\u201d<\/p>\n Research published by Hexastrike connected DUC FABULOUS CO.,LTD with activity they attributed to the threat actor Silver Fox. In Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installers<\/strong><\/a>, Hexastrike reported that the samples carried \u201ca stolen valid Extended Validation code-signing certificate issued by SSL.com to DUC FABULOUS CO.,LTD.\u201d We could not independently corroborate that the certificate’s private key was stolen or compromised. The installation files we examined are unsigned. They contain a copy of UltraViewer that is itself signed with the \u201cDUC FABULOUS CO.,LTD\u201d certificate with SHA1 thumbprint 2C1D12F8BBE0827400A8440AF74FFFA8DCC8097C.<\/p>\n Whatever the explanation for the certificate, Hexastrike\u2019s research led us to additional malicious samples containing UltraViewer. One recent example is a trojanized UltraViewer installer, UltraViewer_setup_6.6.133_vi.exe (SHA-256: 28f046d9f985e58cbc8b245b54d4179feacecc12f41e2f6594306867ce3e8727<\/strong><\/a>), that was submitted to VirusTotal on September 4, 2026, detected as malicious by 60 of 76 vendors and attributed to the Win32.Comet.A family, also known as DarkKometa. The sample installs itself under C:\\ProgramData\\Synaptics\\Synaptics.exe, impersonating the Synaptics touchpad driver to avoid detection. Like the malware above, the installer is unsigned, but it contains a valid certificate for the authentic UltraViewer application bundled within it.<\/p>\n None of our findings implicate the developers of UltraViewer and UltraMailer in the scams or malware distribution described here. What the research does show is persistent criminal abuse of both applications. The distinction matters because free and low-cost software can become valuable infrastructure for threat actors without its developer participating in the crime. The response to that abuse differs between providers. Mail250 suspended the account we reported, and the observed campaign stopped. We found no comparable abuse-reporting mechanism on the UltraMailer website.<\/p>\n![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/the-ultra-trail-from-viewer-to-mailer-image1.jpg\")
<\/p>\n![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/the-ultra-trail-from-viewer-to-mailer-image2.jpg\")
<\/p>\nA Brief Detour to Mail250<\/h3>\n
Built for Bulk, Popular with Spammers<\/h3>\n
![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/the-ultra-trail-from-viewer-to-mailer-image3.jpg\")
<\/p>\nWhen the Mailer Comes with Malware<\/h3>\n
UltraViewer Inside the Malware<\/h3>\n
Abused, but Accountable?<\/h3>\n
![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/the-ultra-trail-from-viewer-to-mailer-image4.jpg\")
<\/p>\n