Fake payroll desktop apps silently install ScreenConnect

One operator used fake desktop apps for three U.S. payroll platforms to silently install unattended ConnectWise ScreenConnect, Allure Security reported.

Allure Security reported that one operator offered fake Windows desktop apps for three unnamed large U.S. payroll and HR platforms that provide only web and mobile clients. Lure sites built with the Lovable AI app builder and hosted on Vercel served NSIS installers from GitHub Releases that display a genuine Microsoft-signed .NET Desktop Runtime 8.0.26 while quietly installing ConnectWise ScreenConnect. The client is configured for unattended access, hides banners, notifications, and tray icons, starts at boot, and persists as a service and scheduled tasks, which can give interactive access to systems holding employee and payroll data. Payloads connected to jyleatyg.com on port 8041 in Germany, and the same LiveChat and GitHub accounts tied the three lures together. GitHub recorded 291 downloads; both reports say that total includes researchers, and The Register also counts sandboxes, so the number of real victims is unknown. Help Net Security also reported that the pages, domain, and GitHub profile were taken down and that how people were directed to the pages was not established.

• Allure Security identified one operator impersonating three unnamed large U.S. payroll and HR platforms that offer only web and mobile apps, not desktop clients.
• Lure sites built with the Lovable AI app builder and hosted on Vercel served NSIS installers from GitHub Releases.
• The installer displays a genuine Microsoft-signed .NET Desktop Runtime 8.0.26, then silently installs ConnectWise ScreenConnect.
• ScreenConnect is set for unattended access, hides banners, notifications, and tray icons, starts at boot, and persists as a service and scheduled tasks.
• Payloads connected to jyleatyg.com on port 8041 in Germany; the same LiveChat and GitHub accounts linked all three lures.
• GitHub recorded 291 downloads, including researchers and sandboxes, so the true victim count is unknown.
• Help Net Security reported the pages, domain, and GitHub profile were taken down; how victims were directed to the pages was not established.