Crooks use fake desktop apps to fool HR staff into giving them remote access
Attackers impersonate US HR and payroll vendors with fake desktop apps that silently install ConnectWise ScreenConnect.
Allure Security reported a campaign impersonating three unnamed US HR and payroll platforms with fake Windows desktop clients those vendors do not sell. Sites built with the Lovable AI app builder and hosted on Vercel serve installers from GitHub Releases that show a legitimate Microsoft .NET Desktop Runtime 8.0.26 installer while quietly installing ConnectWise ScreenConnect. The client is set to unattended access, hides banners and tray icons, starts at boot, and persists across sessions, giving attackers interactive remote access to systems that hold employee data. GitHub download counts totaled 291, though researchers and sandboxes account for some of those and the true victim count is unknown.