Attackers are advertising desktop applications for three large US payroll and HR platforms that have never shipped one. Anyone who installs the download gets a copy of ScreenConnect, the legitimate remote support tool, configured so an operator can control the machine without the user noticing.
Allure Security found the campaign. Its research director, Ryan Merritt, said all three impersonated providers sell browser-based products with mobile companions and no desktop client, so the offer is a giveaway to anyone who checks. Those most likely to install it are the people who run payroll, where unattended access is a path to draining an entire company’s wages.
A real Microsoft installer hides the payload
The lure pages were built with the AI app builder Lovable, saved as single HTML files, and hosted on Vercel behind a bot challenge that stopped scanners from indexing them. Downloads sat on GitHub Releases, borrowing a trusted domain. Each 64MB installer first runs the genuine, Microsoft-signed .NET Desktop Runtime 8.0.26 package, which finishes normally, then installs ScreenConnect silently with msiexec. The promised app never opens, because it does not exist.
The ScreenConnect client runs as a service, survives Safe Mode, and starts before sign-in, with every warning banner disabled. All three lures shared one LiveChat account, one GitHub account, and one command server in Germany. Payroll and HR staff should treat any downloadable client for a web-only platform as hostile.
