A routine business email can turn a standard administrator tool into a channel for computer takeover, without exploiting any vulnerability. Huntress specialists discovered a phishing campaign in which attackers persuaded users to install the legitimate Faronics Deploy platform, then used it to deploy ScreenConnect for remote access. Lures on More Than 457 Endpoints Between 21 July and 20 August, Faronics-related lures appeared on more than 457 endpoints.

Cet article détaille une campagne de phishing active exploitant Faronics Deploy, une plateforme légitime de gestion d'endpoints, pour établir un accès distant non autorisé sur des systèmes victimes. Huntress a observé plus de 457 endpoints exposés à des leurres liés à Faronics entre le 21 juillet et le 20 août.

Phishing actors are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install the ScreenConnect remote support software.

Phishing actors are abusing the legitimate Faronics Deploy platform to enroll victim devices and use remote deployment features to run PowerShell scripts that install ConnectWise ScreenConnect. Huntress observed the campaign delivering Faronics-themed lures to more than 457 endpoints and noted that Faronics has since added anti-abuse measures and contacted affected organizations. #FaronicsDeploy #ConnectWiseScreenConnect #Huntress