Fake payroll desktop apps hand attackers a route to company paychecks

An attacker has been offering “desktop apps” for three large US payroll and HR platforms that have never released one, Allure Security have found. Anyone who runs the installer gets a copy of ScreenConnect, a legitimate remote access tool, configured to let the attacker control the computer without the user knowing.

According to Ryan Merritt, Director of Security Research at Allure Security, all three providers deliver their products as web applications accessed through a browser, with mobile companion apps, and none offers a desktop application for its current platform. The researchers did not disclose which providers were impersonated.

Three payroll desktop-app lures (Source:Allure Security)

The people most likely to install such an app are those who run payroll. Merritt says unattended access to their machine is “a path to diverting or draining an entire company’s payroll.”

The lure pages were created with Lovable, an AI app builder that turns a text prompt into a web page. The operator did not remove the build metadata, and the tags left in the pages show the workflow. The attacker built each page in Lovable, saved its preview as a single HTML file with a browser extension called SavePage WE, and hosted the file on Vercel.

The metadata shows the snapshot was taken from the operator’s own Lovable preview. Each page carried the brand’s logo, product screenshots, a live-chat widget and a download button.

The pages were hosted behind Vercel’s bot-challenge screen. “Automated scanners hit the challenge page and stopped, without accessing the lure, which is why the pages left almost no public scanning footprint while they were live,” added Merritt.

The download button linked to a release file in a GitHub repository. One GitHub account held a separate repository for each brand, and each published the same file under a brand-specific name.

The file is an installer of about 64 MB built with NSIS, the Nullsoft Scriptable Install System. When it runs, it first opens the genuine, Microsoft-signed .NET Desktop Runtime 8.0.26 installer, with a progress window that ends on a success message. It then runs msiexec with the /qn flag, which installs ScreenConnect in the background with no interface. A standard Windows elevation prompt appears between the two steps.

“So the only thing the victim sees is a real Microsoft installer finishing normally. The promised payroll app never opens, because it does not exist, and the one window that did appear belonged to Microsoft. Nothing on screen looks like malware,”Merritt wrote.

The ScreenConnect client is configured for unattended access, with the “under control” banner, tray icon and connection notifications disabled. The client installs as a Windows service, runs in Safe Mode, creates scheduled tasks and loads on the Windows sign-in screen, allowing access before a user logs in.

All payloads connect to an attacker-controlled ScreenConnect server at jyleatyg[.]com (89.213.118[.]127) on port 8041, located in Germany.

Single operator behind the campaign

The three lure pages used the same LiveChat account and the same GitHub account, and all payloads connected to the same ScreenConnect server, which the researchers say ties the campaign to a single operator.

The server and a working payload were in use in August, a month before the branded pages appeared. Those installers were signed with a certificate issued to “Dennis Miller” by SSL.com, which revoked the certificate on July 24, 2026, its issue date. September samples were unsigned.

The GitHub files were downloaded 291 times, a figure that includes researchers and sandboxes. At the time of analysis, 32 of 70 security engines flagged the installer as malicious.

“On reach, the numbers are modest, but when you consider the potential impact of drained company payroll accounts, they are non-trivial,” noted Merritt.

How victims reached the pages, whether through ads, search results or email, has not been established.

Microsoft reported in March 2026 on a campaign that impersonated workplace apps such as Teams, Zoom and Adobe Reader to deploy ScreenConnect and other remote access tools. Huntress reported in September 2026 on rogue ScreenConnect clients spread through tech support lures.

The researchers also found fake desktop apps for cryptocurrency exchange, wallet and DeFi brands using the same tooling and the same type of ScreenConnect payload. They attribute these to a separate operator cluster, with a different signer, certificate authority, code-hosting accounts and live-chat licenses.

The three fake payroll pages, the command-and-control domain and the GitHub profile hosting the installers have since been taken down by Allure Security.

“If your company runs a cloud payroll or HR platform, the most useful thing you can do this week is check whether yours actually ships one, and tell employees that a download the vendor does not offer is not an upgrade. It is the attack,” concluded Merritt.