Fake Desktop Apps for US Payroll Platforms Deploy ScreenConnect for Remote Access

Allure Security discovered an attacker offering fake desktop applications for three large US payroll and HR platforms that have never released desktop versions. The malicious installers deploy ScreenConnect, a legitimate remote access tool, configured to allow the attacker to control the victim's computer without their knowledge. According to Ryan Merritt, Director of Security Research at Allure Security, all three targeted payroll providers deliver their products exclusively as web applications accessed through browsers. The attack gives threat actors potential access to company payroll systems and paychecks through compromised user computers.