Attackers are targeting HR and payroll staff with fake Windows desktop apps for U.S. HR and payroll platforms, then silently installing ScreenConnect so they can remotely control the victim’s computer. Allure Security says the campaign uses AI-built phishing sites hosted on Vercel, GitHub Releases for trusted-looking downloads, and a real Microsoft .NET Desktop Runtime installer as cover while ScreenConnect is installed in unattended mode with user-facing warnings disabled and persistence set at boot.
Why it matters: This can hand attackers quiet, long-term access to systems used to view employee, payroll, and benefits data. Organizations should warn HR and payroll teams that these vendors do not offer desktop apps, block unauthorized remote-management tools, and hunt for unexpected ScreenConnect installs now.
2026.09.25
100% relevant
This article is the first specific report here of a campaign using fake HR/payroll desktop apps as the lure and ScreenConnect unattended access as the payload.
← Back to all stories