Fake payroll desktop apps hand attackers a route to company paychecks
Fake payroll desktop apps silently install ScreenConnect, giving one operator a path to company paychecks.
Allure Security found one operator offering fake desktop apps for three large U.S. payroll and HR platforms that only provide web and mobile apps. The NSIS installer displays the genuine Microsoft-signed .NET Desktop Runtime 8.0.26, then quietly installs ScreenConnect for unattended access with banners and notifications disabled. Payloads connect to jyleatyg.com on port 8041 in Germany, and the same LiveChat and GitHub accounts link all three lures. GitHub recorded 291 downloads, including researchers, before the pages, domain, and profile were taken down. How victims were directed to the pages was not established.
- Three unnamed U.S. payroll platforms were impersonated; none offers a desktop app.
- The NSIS installer shows a genuine Microsoft runtime, then silently installs ScreenConnect.
- Unattended access hides notifications and persists as a service and scheduled tasks.
- One operator, LiveChat account, GitHub account, and German server tied the lures together.
- GitHub recorded 291 downloads before Allure got the pages and profile removed.
- ATT&CK
- T1204.002 Malicious FileT1219 Remote Access ToolsT1036.005 Match Legitimate Name or LocationT1543.003 Windows ServiceT1053.005 Scheduled Task
- Products
- ScreenConnect
- Organizations
- Allure SecurityMicrosoft
- Countries
- United StatesGermany
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | jyleatyg.com | s connect to an attacker-controlled ScreenConnect server at jyleatyg[.]com (89.213.118[.]127) on port 8041, located in Germany. Sing |
| ipv4 | 89.213.118.127 | attacker-controlled ScreenConnect server at jyleatyg[.]com (89.213.118[.]127) on port 8041, located in Germany. Single operator behind |
From the original article
3 min read at helpnetsecurity.com
An attacker has been offering “desktop apps” for three large US payroll and HR platforms that have never released one, Allure Security have found. Anyone who runs the installer gets a copy of ScreenConnect, a legitimate remote access tool, configured to let the attacker control the computer without the user knowing.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.