Crooks use fake desktop apps to fool HR staff into giving them remote access

HR employees, familiar with the company's human resources software, might be enticed by a downloadable Windows version that advertises a faster alternative to the standard web interface. Unbeknownst to them, this app is not what it claims to be. It quietly installs legitimate ScreenConnect software, providing remote access to the attacker's PC.

The cybersecurity firm Allure Security uncovered this trend, describing it as a new twist on abusing remote monitoring and management software like ScreenConnect. The campaign pretends to be three US-based HR and payroll platforms that do not offer a desktop client, tricking unsuspecting HR or payroll staff into downloading the fake client.

The website used to host the fake app is built with AI app builder Lovable and hosted on Vercel, making it difficult to detect as it's hidden behind a cloud host's bot challenge page. The downloads themselves are hosted on a GitHub Releases page, which appears trustworthy. Upon downloading and executing the installer, victims are presented with a Microsoft installer, making it seem like a legitimate piece of software.

However, the real action happens behind the scenes as the installer quietly installs ScreenConnect without any visible indicators. It remains active across user sessions, giving the attacker persistent remote access. Notably, this isn't standard malware; the components involved are legitimate, such as the AI-generated page and the GitHub code platform.

The victims remain unknown, with Allure reporting 291 downloads across the three fake downloads, though this figure may include researchers and be inaccurate.