Fake HR Desktop Apps Deliver Silent Remote Access Malware
Attackers abuse legitimate remote tools to infiltrate corporate systems via HR staff
1Sophisticated HR phishing vector
Attackers are distributing fake Windows desktop apps impersonating legitimate US HR/payroll platforms, exploiting HR professionals' workflow needs. The malicious installers deliver ConnectWise's ScreenConnect remote access tool through a multi-stage deception process. Cybersecurity firm Allure Security discovered the campaign on February 8, noting its abuse of legitimate infrastructure makes detection challenging. The operation specifically targets HR personnel who might welcome performance improvements to their daily tools.
2Multi-layer deception tactics
The attack chain uses entirely legitimate services: AI-built fake websites hosted on Vercel, downloads served via GitHub Releases, and Microsoft-branded installers. Victims see what appears to be a normal .NET runtime installation completing successfully. This clean appearance means traditional malware detection methods would miss the attack. The campaign currently impersonates three unnamed HR platforms, none of which actually offer desktop clients - a key red flag for security teams to communicate.
3Persistence mechanisms
The installed ScreenConnect client runs in unattended mode with all victim-facing indicators disabled - no connection banners, tray icons, or notifications. It's configured to launch on system boot and maintain connections across user sessions. Allure Security describes this as giving attackers 'a quiet, persistent, interactive foothold.' The legitimate RMM tool performs exactly as designed, just for unauthorized parties who shouldn't have access.
4Current infection metrics
As of Allure's report, the GitHub download counts for the three fake HR apps totaled 291. However, this includes security researchers and sandbox environments testing the files. The actual number of compromised organizations remains unknown. The low volume suggests targeted deployment rather than mass spraying, though the campaign's infrastructure could scale rapidly if uncontained.
5Detection challenges
Traditional security tools struggle with this attack since it uses no malware in the conventional sense. Every component - the website, download host, and installed software - appears legitimate. Security teams must verify with HR vendors about desktop client availability as a first detection step. The absence of such offerings should trigger immediate alerts to HR and payroll departments about this specific threat vector.
6Broader RMM abuse trend
This campaign represents an evolution in abusing legitimate remote monitoring and management tools like ScreenConnect. Attackers increasingly prefer such methods over traditional malware to bypass security controls. The HR vertical is particularly vulnerable due to the sensitivity of handled data and employees' need for efficient tools. Similar attacks have targeted other business functions through fake productivity apps.
7Defensive recommendations
Beyond verifying desktop client availability, organizations should implement application allowlisting to prevent unauthorized RMM tool installations. HR teams require specific training about this novel phishing vector emphasizing that performance-enhancing claims for web-based tools should be treated as red flags. Network monitoring for unexpected ScreenConnect traffic becomes critical given the tool's legitimate use in many enterprises.
8Supply chain implications
The attack highlights risks in the growing ecosystem of legitimate SaaS tools, AI website builders, and code hosting platforms being weaponized. Security teams must expand monitoring beyond traditional malware to include anomalous usage patterns of approved software. This incident particularly underscores the need for tighter controls around RMM tools given their powerful access capabilities when abused.