An attacker created fake desktop app pages for three major US payroll and HR platforms that do not offer desktop apps, then used them to install ScreenConnect for hidden remote access. The campaign used AI-generated lure pages, GitHub-hosted installers, and a single command-and-control server to potentially divert or drain payroll accounts. #ScreenConnect #Lovable #Vercel #GitHub
Keypoints
- Fake desktop app lures targeted three US payroll and HR platforms that only offer web access.
- Victims who ran the installer received ScreenConnect with unattended remote access enabled.
- The lure pages were built with Lovable and hosted on Vercel behind a bot-challenge screen.
- Installers downloaded from GitHub first launched a real Microsoft .NET installer, then silently installed ScreenConnect.
- All payloads connected to one attacker-controlled ScreenConnect server in Germany, linking the campaign to a single operator.
Read More: https://www.helpnetsecurity.com/2026/09/25/fake-payroll-desktop-apps-screenconnect/