Crooks use fake desktop apps to fool HR staff into giving them remote access
Attackers impersonate US HR and payroll vendors with fake desktop apps that silently install ConnectWise ScreenConnect.
Allure Security reported a campaign impersonating three unnamed US HR and payroll platforms with fake Windows desktop clients those vendors do not sell. Sites built with the Lovable AI app builder and hosted on Vercel serve installers from GitHub Releases that show a legitimate Microsoft .NET Desktop Runtime 8.0.26 installer while quietly installing ConnectWise ScreenConnect. The client is set to unattended access, hides banners and tray icons, starts at boot, and persists across sessions, giving attackers interactive remote access to systems that hold employee data. GitHub download counts totaled 291, though researchers and sandboxes account for some of those and the true victim count is unknown.
- Fake desktop apps impersonate three US HR and payroll platforms that offer no desktop client.
- GitHub-hosted installers quietly deploy unattended ConnectWise ScreenConnect remote access.
- The only visible install is Microsoft .NET Desktop Runtime 8.0.26.
- ScreenConnect hides control banners and tray icons and starts at boot.
- Download counts totaled 291, but the real victim number is unknown.
- ATT&CK
- T1204.002 Malicious FileT1219 Remote Access ToolsT1036 MasqueradingT1547 Boot or Logon Autostart Execution
- Vendors
- ConnectWiseMicrosoft
- Organizations
- Allure SecurityLovableVercelGitHub
- Countries
- United States
From the original article
3 min read at theregister.comNothing in the attack chain screams malicious software, except none of the impersonated HR and payroll providers actually offers a desktop app
By Brandon Vigliarolo · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.