Hackers build fake desktop apps to trick victims into handing over access

Date:
Tue, 29 Sep 2026 01:20:00 +0000

Description:
Finance and HR departments are being offered tools that don't exist, tricking them into handing over valuable access.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Threat actors spoofed major US HR/payroll platforms with fake desktop clients built via Lovable landing
pages Victims downloaded a modified ScreenConnect build from GitHub, giving attackers hidden, unattended remote access Campaign shows ~291 downloads; likely targets payroll staff, enabling potential wire fraud through diverted payments Cybercriminals are impersonating large American HR and payroll platforms in attacks that are very difficult to spot, new research from
Allure has claimed.

Its report revealed how the as-yet unidentified threat actors were found spoofing three major US HR and payroll platforms, likely picked primarily because they offered a cloud-based service accessible through a browser, rather than a standalone desktop app. The crooks used Lovable (a legitimate AI-powered service for building websites and landing pages with nothing more than prompts, requiring no technical knowledge whatsoever) to create landing pages imitating the legitimate brands, but with a small (yet important) distinction - they offered a desktop client. Latest Videos From TechRadar Watch full video here: No reference points Since a legitimate desktop client does not exist, there is nothing to compare the malware to. This, Allure
says, makes it very difficult for victims to determine they were being targeted. After all, it would make sense for a major HR and payroll platform to have a desktop app at one point, right?

Those that clicked the download button were served an executable from GitHub Releases, a feature of GitHub that developers use to publish specific, packaged versions of their software. You can think of it as the software equivalent of a product download page. Being a legitimate service (and one frequently used to host software like this), it yet raises no suspicions or red flags. You may like Beware these new phishing attacks use a convincing fake Adobe Reader pages to trick victims into installing malware Microsoft login pages are being abused as hackers try and lure in unlucky victims Hackers use fake Adobe and Zoom updates to load malware onto victim devices

The executable itself is not malicious either, which is probably the
cheekiest part of the attack. As such, it flies under the radar of most antivirus or endpoint protection services and can easily be installed on the device. "Legitimate" tools Well if its not malicious, what is it? And what is the risk? Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

The program victims end up installing is a variant of ConnectWises ScreenConnect, a remote desktop and remote IT support platform used primarily by IT departments and managed service providers (MSP). It is a legitimate
tool that allows IT techs to remotely connect to computers and servers, troubleshoot problems, install software and patches, and more.

But because ScreenConnect provides remote, often privileged access to computers, it is an attractive tool for attackers, and is often used in cyberattacks of different nature.

This build was configured to surreptitiously do the same thing without the user being aware. We extracted the client configuration and the launch parameters. The access mode is set to unattended. The victim-facing
indicators are turned off: no your machine is being controlled banner, no system-tray icon, no connection balloon, the researchers said. What to read next New malware targets Microsoft Teams users by posing as your company's IT helpdesk IT helpdesk impersonation hits Microsoft Teams once again, with the hackers hiding their activity within legitimate tools This North Korean recruitment scam was so convincing it even fooled Google

In other words, the variant was configured to allow crooks access without notifying the victim in any way.

Allure did not identify the attackers, nor did it discuss the success of the campaign. We dont know exactly who it targeted (apart that it aims for
finance and HR departments), or how many organizations ended up installing ScreenConnect. The researchers said the GitHub downloads page shows 291 downloads, but that doesnt necessarily have to mean 291 victims, or
successful attacks. It is likely that numerous security researchers
downloaded the tools, as well as sandboxes, and that many of the victims realized they were attacked before suffering any meaningful damage.
Therefore, the actual number of victims is likely significantly smaller.

We also dont know what the endgame is, although Allure suggests it might be wire fraud:

Whoever installs it is the person who runs payroll, and unattended access to that machine is a path to diverting or draining an entire companys payroll, they said.

If your company runs a cloud payroll or HR platform, the most useful thing
you can do this week is check whether yours actually ships one [desktop client], and tell employees that a download the vendor does not offer is not an upgrade. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/hackers-build-fake-desktop-apps-to-tric k-victims-into-handing-over-access


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)