Attackers are exploiting a simple gap in HR knowledge: none of the major US payroll and HR platforms actually offer desktop applications, yet criminals are successfully convincing employees they do. Security researchers at Allure Security discovered a sophisticated campaign where fake desktop apps for three unnamed HR and payroll providers silently install ScreenConnect, a legitimate remote access tool, giving attackers undetected control over company computers.

Why Are HR Departments Such Attractive Targets?

HR and payroll staff have access to some of the most sensitive company information available: employee personal data, bank account details, salary information, and payment systems. An attacker with unattended access to a payroll clerk's computer could potentially divert or drain an entire company's payroll, according to Ryan Merritt, Director of Security Research at Allure Security. This makes HR departments far more valuable targets than typical employees, even though they may be less security-conscious than IT staff.

The campaign's sophistication lies in its use of legitimate tools at every step. The fake websites were built using Lovable, an AI app builder that converts text prompts into web pages, and hosted on Vercel, a trusted cloud platform. The download links pointed to GitHub Releases, another trusted domain. When victims ran the installer, they saw a genuine Microsoft installer window for the.NET Desktop Runtime, making everything appear legitimate.

How Does the Attack Actually Work?

The attack chain is designed to avoid triggering security alarms at every stage. Here's what happens when a victim downloads and runs the fake app:

• Initial Deception: The victim sees a professional-looking website for their HR or payroll provider, complete with logos, product screenshots, and a live-chat widget, all built with Lovable's AI app builder.
• Trusted Download Source: The download button links to a GitHub repository, a platform trusted by developers and IT professionals, making the source appear legitimate.
• Legitimate-Looking Installation: When executed, the installer first displays a genuine Microsoft.NET Desktop Runtime installer with a progress window and success message, creating the impression of a normal software installation.
• Silent Malicious Installation: While the victim watches the Microsoft installer complete, the malware simultaneously runs a hidden command using msiexec with the /qn flag, which installs ScreenConnect in the background with no visible interface.
• Persistent Access: The ScreenConnect client is configured for unattended access, meaning the attacker can control the computer without any warning banners, system tray icons, or connection notifications appearing on screen.

As Allure Security noted, "Nothing in this chain is malware in the usual sense. The page was generated by a legitimate AI builder and served by a legitimate host. The download came from a legitimate code platform. The one window the victim saw belonged to Microsoft. The thing that was installed is a legitimate RMM product, doing what it was designed to do, for someone who was never supposed to have it".

What Makes This Campaign So Hard to Detect?

The attackers deliberately obscured their tracks using several techniques. The fake websites were hosted behind Vercel's bot-challenge page, which stops automated security scanners from accessing the content. This meant the malicious pages left almost no public scanning footprint while they were active. The attacker also failed to remove build metadata from the Lovable-generated pages, which actually helped researchers trace the workflow, but this oversight didn't prevent the campaign from operating for weeks.

The ScreenConnect client was configured with all victim-facing indicators disabled: no "your machine is being controlled" banner, no system-tray icon, and no connection balloon. The client installs as a Windows service, runs in Safe Mode, creates scheduled tasks, and loads on the Windows sign-in screen, allowing the attacker access even before a user logs in.

How Many Companies Were Actually Compromised?

The exact number of victims remains unknown. The GitHub download counts across the three fake applications totaled 291 downloads as of Allure's report, but this figure includes downloads from security researchers and sandboxes, so it cannot be used to determine actual victim numbers. However, at the time of analysis, 32 of 70 security engines flagged the installer as malicious, suggesting the campaign was not widely detected.

The campaign appears to be operated by a single threat actor, based on evidence that all three fake websites used the same LiveChat account, the same GitHub account, and all payloads connected to the same ScreenConnect server located in Germany at jyleatyg.com on port 8041. The server and working payload were in use in August, a month before the branded pages appeared, suggesting the attacker had been preparing the infrastructure for some time.

Steps to Protect Your HR Department

• Verify Desktop App Availability: Contact your HR and payroll software vendors directly to confirm whether they actually offer a desktop application. If they do not, alert all HR and payroll staff that any downloadable desktop app claiming to be from that vendor is not legitimate.
• Educate Staff on Vendor Offerings: Many HR and payroll platforms deliver their products exclusively as web applications accessed through a browser, with mobile companion apps available. Train employees to recognize that a desktop app offer from these vendors is a red flag.
• Implement Download Verification Procedures: Require HR staff to verify any software downloads through official vendor websites or support channels before installation. Establish a policy that all software downloads must be approved by IT before execution.
• Monitor for Suspicious Installations: Watch for unexpected ScreenConnect installations or any remote access tools on HR department computers. Check for the presence of ScreenConnect services, scheduled tasks, or Windows services that were not explicitly authorized.
• Review GitHub and Vercel Access Logs: If your organization uses GitHub or Vercel, review access logs for any suspicious downloads or repository activity that could indicate an employee was targeted by this campaign.

Allure Security has since taken down the three fake payroll pages, the command-and-control domain, and the GitHub profile hosting the installers. However, the researchers emphasized that the most useful action companies can take is to verify whether their HR and payroll vendors actually offer desktop applications, and to communicate clearly to employees that a download the vendor does not offer is not an upgrade, but an attack.

The campaign highlights a broader trend of attackers abusing ScreenConnect and other remote monitoring and management software. Microsoft reported in March 2026 on a similar campaign impersonating workplace apps such as Teams, Zoom, and Adobe Reader to deploy ScreenConnect and other remote access tools. Huntress also reported in September 2026 on rogue ScreenConnect clients spread through tech support lures, indicating this attack vector is becoming increasingly common.

Researchers also discovered fake desktop apps for cryptocurrency exchanges, wallets, and decentralized finance platforms using the same tooling and ScreenConnect payload, though these appear to be operated by a separate threat actor cluster with different signers, certificate authorities, and code-hosting accounts. This suggests the techniques pioneered in the HR payroll campaign are being adapted and replicated across multiple attack campaigns.