Fake Payroll App Installers Deploy ScreenConnect for Hidden Remote Access
Summary
Researchers found fake desktop-app pages for three payroll and HR platforms delivered ScreenConnect with unattended access. Shared accounts and a server linked the campaign to one operator; how victims found the pages is unknown.
Key points
- Fake desktop-app pages impersonated three US payroll and HR platforms that offer web access but no desktop app; researchers did not name the providers.
- Installers linked from GitHub launched a genuine Microsoft .NET Runtime installer, then silently installed ScreenConnect after a Windows elevation prompt.
- ScreenConnect was configured for unattended access, with notifications and visible indicators disabled; it ran as a Windows service and could load at the sign-in screen.
- All payloads connected to the same attacker-controlled ScreenConnect server, jyleatyg[.]com, on port 8041; shared GitHub and LiveChat accounts also linked the lures to one operator.
- The GitHub files had 291 downloads, including researchers and sandboxes; 32 of 70 security engines flagged the installer as malicious at the time of analysis.
- Researchers had not established how victims reached the pages. Allure Security later took down the pages, server, and GitHub profile hosting the installers.
- The researchers advise organizations to verify whether their payroll or HR provider actually offers a desktop app and warn employees against downloading unofficial apps.
Article Details
- Attack Vectors
- Fake desktop-app pages impersonated three unnamed US payroll and HR platforms and offered installers for products that are web-only.
- The lure pages were built with Lovable, saved as HTML using SavePage WE, and hosted on Vercel behind a bot-challenge screen.
- Download buttons linked to brand-specific GitHub release files. Running an installer launched a genuine Microsoft .NET Desktop Runtime 8.0.26 installer, then silently installed ScreenConnect using msiexec with the /qn flag.
- ScreenConnect was configured for unattended access with its banner, tray icon, and connection notifications disabled. It installed as a Windows service, ran in Safe Mode, created scheduled tasks, and loaded at the Windows sign-in screen.
- Defensive Notes
- Organizations using cloud payroll or HR platforms should verify whether their vendor actually offers a desktop application and tell employees not to install downloads the vendor does not provide.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | jyleatyg[.]com | Attacker-controlled ScreenConnect server used by all payloads for remote access. |
| IPV4 | 89[.]213[.]118[.]127 | IP address of the attacker-controlled ScreenConnect server used by all payloads. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationFake desktop-app pages and brand-specific installers impersonated payroll and HR platforms.T1053.005 · Scheduled TaskThe ScreenConnect client created scheduled tasks.T1204.002 · Malicious FileVictims were lured into running fake payroll desktop-app installers.T1218.007 · MsiexecThe installer invoked msiexec with /qn to install ScreenConnect silently.T1219 · Remote Access ToolsThe installers deployed ScreenConnect, configured for attacker-controlled unattended remote access.T1543.003 · Windows ServiceThe ScreenConnect client installed as a Windows service.T1547.014 · Active SetupThe ScreenConnect client loaded at the Windows sign-in screen, allowing access before a user logged in.
People
Vendors
Products
GitHubThe campaign used AI-generated lure pages, GitHub-hosted installers, and a single command-and-control server to potentially divert or drain payroll accounts.Lovable#ScreenConnectScreenConnectAn attacker created fake desktop app pages for three major US payroll and HR platforms that do not offer desktop apps, then used them to install ScreenConnect for hidden remote access.Vercel#ScreenConnect
Tools
msiexecIt then runs msiexec with the /qn flag, which installs ScreenConnect in the background with no interface.NSISThe file is an installer of about 64 MB built with NSIS, the Nullsoft Scriptable Install System.SavePage WEThe attacker built each page in Lovable, saved its preview as a single HTML file with a browser extension called SavePage WE, and hosted the file on Vercel.