Fake payroll desktop apps give attackers a route to company paychecks

Allure Security found three fake "desktop apps" for large US payroll and HR platforms that never released one. The ~64 MB installer silently deploys a legitimate ScreenConnect remote-access client with unattended access, giving attackers a path to drain a company's payroll.

• The ~64 MB installer first runs Microsoft-signed .NET Runtime 8.0.26, then silently installs ScreenConnect
• The client runs as a Windows service, in Safe Mode and at the sign-in screen, with banners and notifications disabled
• GitHub files were downloaded 291 times; 32 of 70 security engines flagged the installer as malicious
• All three lures and the Germany-based C2 server tie to one operator; the pages have been taken down