revel8’s recent analysis uncovered a phishing campaign impersonating DATEV eG that weaponizes PDQ Connect, a legitimate remote-management platform, to establish unauthorized administrative control over victim devices. DATEV is a major German software and IT services provider, widely used in the German business ecosystem.
Although the email was delivered through SendGrid and technically passed SPF/DKIM for sendgrid.net, the campaign relied on brand impersonation, website crawling, and staged delivery to deploy PDQ Connect as a remote-access foothold.
The message was sent through SendGrid infrastructure (outbound-mail.sendgrid.net) with SPF/DKIM pass. However, the sender display name posed as “DATEV-Serviceinformationen”, while the actual From field was a Gmail address, causing DMARC to fail.
The email was routed through multiple servers and contained extremely long tracking and unsubscribe links. The redirector (SendGrid) implemented logic that returned different content depending on IP, geolocation, user-agent, or referrer. Testing from outside the victim’s region consistently returned a benign Facebook homepage - demonstrating geo/IP filtering, where malicious content is shown only to intended targets while benign content is served to others to evade detection.
After SendGrid logs the click, it redirects the user to the attacker’s final landing page which, in this case, provides an MSI that installs PDQ Connect. PDQ Connect is legitimate RMM/agent software, but when installed under attacker control it functions essentially as a RAT, enabling remote administrative control.
PDQ Connect installs as a service/agent and can be configured to persist across reboots. With that foothold, attackers can execute commands remotely, harvest credentials and tokens, trigger ransomware and install malware.
This DATEV-themed phishing campaign used SendGrid delivery, website-scraped branding, and long tracked redirects to guide users to PDQ Connect, a legitimate remote-management tool. Because the activity was identified early, no endpoints were compromised. In controlled testing, the full delivery chain could not be observed, as the click-tracking system prevented access to the intended payload. All IOCs identified in the message headers, URLs, and delivery chain were flagged and reported to the appropriate service providers.
This threat model matches NJCCIC reporting describing PDQ Connect-based campaigns distributing MSI installers through phishing themes such as tax forms and voicemail notices.
Senders:
quynhquocbuirte@gmail[.]com
bichsam88272@gmail[.]com
saojfgopw7492@gmail[.]com
Lana Kuzmina is a Cyber Threat Analyst at revel8, specializing in OSINT, threat actor tracking, and intelligence reporting. With experience across early threat detection and malware research, she brings a sharp eye for uncovering emerging attack techniques and translating them into actionable insights for defenders.
