A campaign offers fake desktop clients for three US payroll platforms, then installs ScreenConnect to give an attacker unattended access…