Loading story…
A phishing campaign impersonating Bank of America is targeting victims with different payloads based on device type. Huntress reported that non-Windows users are redirected to credential-harvesting pages that solicit usernames, passwords, personally identifiable information, Social Security numbers, government ID details, and payment card data, while Windows users are lured into downloading a fake "Account Guard" installer presented as a ZIP file.
On Windows systems, the installer launches a multi-stage infection chain using VBScript and layered Base64-decoded PowerShell to download and silently install ScreenConnect for persistent remote access. The malware abuses the ICMLuaUtil elevated COM interface to bypass UAC and gain administrator privileges without prompting the user, then hides itself as a "Windows Security" service, alters uninstall visibility, and modifies SDDL and ACL settings to hinder removal. Huntress linked the activity to domains including bkofamerica[.]com, kleinschnitg[.]com, and sectioncompil[.]com, and said the ScreenConnect implant communicated with 217.60.195[.]167 over TCP port 8041.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Huntress detected the campaign after a phishing message impersonating Bank of America reached one of its honeytrap/spamtrap accounts. The email used a spoofed sender and a time-sensitive account confirmation lure to pressure recipients into clicking.
Huntress released indicators of compromise for the campaign, including malicious domains, the command-and-control IP address, and file hashes tied to the phishing and malware stages. The published IOCs covered artifacts such as the fake installer archive, scripts, and ScreenConnect payloads.
Huntress analyzed the campaign and found that non-Windows visitors were redirected to credential-harvesting pages, while Windows users were served a fake "Account Guard" download that launched a multi-stage infection chain. The Windows path installed ScreenConnect with an ICMLuaUtil COM-based UAC bypass, disguised the service as "Windows Security," and used SDDL/ACL changes to hinder detection and removal.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourceinfosecurity-magazine.com
Open sourceitsecurityguru.org
Open sourcehuntress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported multiple phishing-driven intrusions in which attackers impersonate trusted brands and agencies to trick victims into installing legitimate remote monitoring and management (RMM) software for persistent access. In **Operation DoppelBrand**, financially motivated actor **GS7** spoofed Fortune 500 financial and technology brands (including **Wells Fargo** and **USAA**) using more than **150** lookalike domains to harvest credentials and exfiltrate data via attacker-controlled **Telegram bots**; researchers also identified nearly **200** additional domains with short registration terms, automated SSL, wildcard DNS, and brand-specific subdomains supporting the campaign. Separately, Forcepoint X-Labs described a wave of emails impersonating the **U.S. Social Security Administration** that delivers an attached `.cmd` script to weaken Windows defenses and enable silent installation of **ConnectWise ScreenConnect**. The script checks/elevates privileges, disables **Windows SmartScreen** via registry changes, removes **Mark-of-the-Web**, and uses **Alternate Data Streams (ADS)** for stealth before installing an MSI and configuring ScreenConnect (via `System.config`) to beacon to an attacker-controlled server (reported as `dof-connecttop` on port `8041`). Both activity sets highlight a recurring tradecraft pattern: **brand impersonation + scripted defense evasion + abuse of legitimate RMM tooling** (e.g., *LogMeIn Resolve*, *ScreenConnect*) to gain remote control and facilitate follow-on theft or persistence.
Jun 29, 2026
Huntress investigated two late-August phishing intrusions in which attackers used browser-in-the-browser (BiTB) pages impersonating Adobe Acrobat or Reader to convince victims to install unauthorized ScreenConnect remote-management clients. Victims were led through malicious links and fake CAPTCHA or PDF-viewer lures to counterfeit Adobe browser windows that displayed the legitimate-looking `get.adobe.com` address within page content. In each incident, the initial ScreenConnect installation downloaded and installed a second rogue ScreenConnect client, providing redundant service-based persistence and remote-access channels. The attackers also ran `HideCursor.exe` or `HideUL.exe` to conceal interactive activity; Huntress contained both intrusions before additional compromise. Microsoft Defender detected a command associated with `patch.msi` in one case but did not stop deployment of the second ScreenConnect client.
Sep 10, 2026
Researchers reported an active **Smoke#Screen** social-engineering campaign that tricks victims into installing the legitimate, ConnectWise-signed **ScreenConnect** remote monitoring and management tool, giving attackers persistent remote access while blending in with normal IT activity. The operation targets both **Windows** and **macOS** users and uses multiple lures, including fake **Zoom** and **Adobe** updates, document-review requests, and a **SystemCheck** maintenance tool. Securonix linked the activity to a live staging server at `207.174.0.143:8080`, reconstructed five kill chains, and tied the campaign to three attacker-controlled ScreenConnect relay clusters. The attackers rotated payloads between download sessions and used a mix of **VBScript droppers**, batch loaders, compiled **.NET** executables, phishing HTML pages, **Dropbox** links, **Cloudflare Quick Tunnels**, encrypted bundles, and a **WsgiDAV** staging server to frustrate hash-, signature-, and reputation-based detection. Researchers said the tradecraft evolved from obfuscated, sandbox-aware droppers to loaders that disabled Microsoft Defender and later to stealthier variants that delayed execution to evade Elastic correlation, underscoring that **behavioral detection** is more effective than relying on software trust or static indicators alone.
Aug 7, 2026