Loading story…
An unidentified threat operator impersonated three U.S. payroll and HR providers with fraudulent desktop-app download pages, despite the legitimate services being browser-only. The installers showed a legitimate Microsoft-signed .NET Desktop Runtime installation as decoy activity while silently deploying a customized ScreenConnect remote-access client, giving the attacker unattended control of Windows systems used by payroll personnel.
The operation used Lovable-generated phishing pages hosted on Vercel behind bot challenges and GitHub repositories distributing brand-specific NSIS installers. The implanted ScreenConnect clients connected to an attacker-controlled server at jyleatyg[.]com over port 8041, exposing victims to payroll-account takeover, payment diversion, and theft; Allure Security linked the lures to one operator and reported the pages, GitHub profile, and command-and-control domain were taken down.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Samples from September were unsigned, unlike earlier installers that used the subsequently revoked SSL.com certificate.
The attacker-controlled ScreenConnect server at jyleatyg[.]com and an operational payload were active, preceding the appearance of the branded payroll lure pages.
SSL.com revoked a certificate issued to Dennis Miller that had been used to sign earlier malicious installers. The revocation occurred on the certificate's stated issuance date.
Allure Security reported that the fraudulent payroll pages, the ScreenConnect C2 domain, and the GitHub profile distributing the installers were taken down.
An unidentified operator impersonated three U.S. payroll and HR platforms with Vercel-hosted lure pages and GitHub-hosted NSIS installers. The installers used a legitimate .NET Runtime installer as a decoy before silently installing an unattended ScreenConnect client connected to the actor's server.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported an active **Smoke#Screen** social-engineering campaign that tricks victims into installing the legitimate, ConnectWise-signed **ScreenConnect** remote monitoring and management tool, giving attackers persistent remote access while blending in with normal IT activity. The operation targets both **Windows** and **macOS** users and uses multiple lures, including fake **Zoom** and **Adobe** updates, document-review requests, and a **SystemCheck** maintenance tool. Securonix linked the activity to a live staging server at `207.174.0.143:8080`, reconstructed five kill chains, and tied the campaign to three attacker-controlled ScreenConnect relay clusters. The attackers rotated payloads between download sessions and used a mix of **VBScript droppers**, batch loaders, compiled **.NET** executables, phishing HTML pages, **Dropbox** links, **Cloudflare Quick Tunnels**, encrypted bundles, and a **WsgiDAV** staging server to frustrate hash-, signature-, and reputation-based detection. Researchers said the tradecraft evolved from obfuscated, sandbox-aware droppers to loaders that disabled Microsoft Defender and later to stealthier variants that delayed execution to evade Elastic correlation, underscoring that **behavioral detection** is more effective than relying on software trust or static indicators alone.
Aug 7, 2026
Threat actors abused the legitimate **Faronics Deploy** cloud endpoint-management platform to enroll victim devices into attacker-controlled deployments, execute remote PowerShell scripts, and install **ConnectWise ScreenConnect** for persistent interactive remote access. From July 21 to August 20, the campaign exposed more than 457 endpoints through invoice, tax-document, and business-file phishing lures. Victims were directed to cloaked, fingerprinting-enabled phishing pages and persuaded to run signed Faronics installers masquerading as Adobe software, documents, or updates. The attackers used Faronics Deploy to retrieve follow-on tooling and establish a ScreenConnect channel independent of the abused management platform. Faronics was notified on August 5, implemented anti-abuse controls, and contacted potentially affected organizations; observed activity dropped substantially after August 21. Organizations should investigate unexpected ScreenConnect installations, review `Faronics ScriptRunner.log` for remotely supplied script URLs, and use Faronics configuration-request `ck` deployment identifiers to identify systems enrolled in malicious deployments.
Sep 5, 2026
Huntress identified a campaign in which attackers use social engineering—including fake technical support, phishing, fraudulent refund-search results, and Quick Assist abuse—to persuade victims to install trojanized ConnectWise ScreenConnect clients. Rather than exploiting a ScreenConnect vulnerability, the altered remote-support software detects incoming sessions and uses ScreenConnect file-transfer and remote-execution functions to send a staged four-part VBScript loader to the connecting endpoint, potentially infecting technician and help-desk systems without further user interaction. The payload chain profiles hosts, establishes persistence, seeks elevated execution, and can deploy remote-access, tunneling, and cryptocurrency-mining tools while attempting to evade security controls, including Microsoft Defender reporting and User Account Control. Huntress observed the activity at unrelated organizations during late-August incidents and advises organizations to reimage confirmed compromised systems, review ScreenConnect deployments and audit logs, and investigate suspicious Windows Script Host or PowerShell execution linked to ScreenConnect sessions.
Sep 8, 2026