Fake Payroll Apps Deploy ScreenConnect for Payroll Theft

Cybercriminals are employing a sophisticated social engineering tactic by distributing fake desktop applications for prominent US payroll and human resources platforms. These malicious installers, designed to mimic legitimate software, are being used to deploy ScreenConnect, a legitimate remote access tool, granting attackers unauthorized control over victim systems. The primary goal appears to be the diversion or outright theft of company payroll funds.

According to research by Allure Security, the targeted payroll and HR providers exclusively offer their services via web applications and mobile companions, with no desktop versions available for their current platforms. Attackers created convincing lure pages using AI website builders like Lovable, complete with brand logos, product screenshots, and live-chat widgets. These pages were hosted on Vercel and protected by bot challenges, minimizing their public scanning footprint.

The download links from these lure pages directed users to GitHub repositories containing installers. Each installer, built with the Nullsoft Scriptable Install System (NSIS), first presented a legitimate, Microsoft-signed .NET Desktop Runtime installer. Upon successful installation of the runtime, the system silently installed ScreenConnect in the background using msiexec with the /qn flag. The entire process was designed to appear as a standard Microsoft update, with the promised payroll application never materializing.

Once installed, the ScreenConnect client is configured for stealthy, unattended access. Critical features like the "under control" banner, tray icon, and connection notifications are disabled. The tool is set up to run as a Windows service, operate in Safe Mode, create scheduled tasks, and launch on the Windows sign-in screen, ensuring persistent access even before a user logs in. All compromised systems connect to a single attacker-controlled ScreenConnect server located in Germany.

Analysis by Allure Security indicates that a single operator is behind this campaign, evidenced by the use of identical live-chat accounts, GitHub profiles, and a shared command-and-control server. While some early payloads were signed with a certificate issued to "Dennis Miller," this certificate was revoked shortly after its issuance, and later samples were unsigned. The GitHub repositories saw a modest number of downloads, but the potential impact of compromising payroll systems makes this campaign highly concerning.

This campaign echoes previous tactics observed in the cybersecurity landscape. Microsoft previously reported on threat actors impersonating workplace applications to deploy ScreenConnect, and Huntress has documented similar rogue ScreenConnect clients distributed through tech support lures. The attackers also leveraged similar tooling to distribute fake desktop applications for cryptocurrency exchanges and wallets, though this appears to be the work of a different threat actor cluster.

Allure Security has since taken down the malicious lure pages, command-and-control domains, and GitHub repositories associated with this specific payroll-focused campaign. However, the underlying technique remains a significant threat. Security researchers emphasize that users should be wary of any unsolicited software downloads, especially for services that are known to be web-based, as they may represent an attack vector rather than a legitimate update or application.

"If your company runs a cloud payroll or HR platform, the most useful thing you can do this week is check whether yours actually ships one, and tell employees that a download the vendor does not offer is not an upgrade. It is the attack," concluded Merritt. The incident serves as a stark reminder of the evolving methods attackers use to gain initial access and the critical importance of user education in cybersecurity defenses.