Phishing Campaign Abuses Faronics Deploy to Install ScreenConnect

Threat actors abused the legitimate Faronics Deploy cloud endpoint-management platform to enroll victim devices into attacker-controlled deployments, execute remote PowerShell scripts, and install ConnectWise ScreenConnect for persistent interactive remote access. From July 21 to August 20, the campaign exposed more than 457 endpoints through invoice, tax-document, and business-file phishing lures. Victims were directed to cloaked, fingerprinting-enabled phishing pages and persuaded to run signed Faronics installers masquerading as Adobe software, documents, or updates.

The attackers used Faronics Deploy to retrieve follow-on tooling and establish a ScreenConnect channel independent of the abused management platform. Faronics was notified on August 5, implemented anti-abuse controls, and contacted potentially affected organizations; observed activity dropped substantially after August 21. Organizations should investigate unexpected ScreenConnect installations, review Faronics ScriptRunner.log for remotely supplied script URLs, and use Faronics configuration-request ck deployment identifiers to identify systems enrolled in malicious deployments.