Fake Bank of America Email Pushes Hidden ScreenConnect

Attackers are impersonating Bank of America in mass phishing emails to pressure people into clicking a link “to avoid account restrictions.” Mac users are led to a fake login page that steals credentials and personal/financial data, while Windows users are tricked into installing a ScreenConnect remote access tool disguised as “Account Guard,” then it’s deliberately hidden and made difficult to uninstall.

Key findings

• Phishing emails impersonate Bank of America and urge recipients to act “to avoid account restrictions.”
• Mac victims are sent to a BoA lookalike page prompting username/password and then additional personal and financial information.
• Windows victims are sent to a different BoA lookalike page that pushes a fake security tool called “Account Guard,” downloading AccountGuardSetup.zip.
• Running AccountGuardSetup.vbs triggers a chain that installs a custom ScreenConnect RMM client, enabling remote access by the attacker.
• The install uses a UAC bypass to install with Administrator privileges “without triggering a user prompt.”
• ScreenConnect is registered as a Windows service named “Windows Security” and then hidden so it does not appear in installed apps and cannot be uninstalled normally.
• The attackers use SDDL/ACLs to block changes and conceal the process; common Windows service tools may not show the service.
• Campaign appears to be broad, generic brand impersonation (mass-blasted), and adapts lures based on victim OS to maximize yield.

Who’s being targeted

• Commonly targeted roles: All employees, Executives, Finance/Accounting, IT helpdesk (for triage and incident routing).
• Affected industries: Banking, Financial services, Consumers/retail banking customers.
• Attack channels: email, website.
• Impersonated: Bank of America (online banking alerts), Bank of America (account security/update).

Awareness takeaways

• Treat “urgent account restriction” emails as suspicious; don’t click, go to the bank site using a known bookmark or the official app.
• Never install software from an email link for “account protection” or “security updates,” especially ZIP/VBS files.
• Verify the website domain in the browser address bar before entering credentials; unrelated domains are a major red flag.
• If remote access software is installed unexpectedly (or the machine becomes hard to manage), treat it as a security incident and escalate immediately.

Red flags to watch for

• Sender/domain doesn’t match the real Bank of America domain
• Urgency/pressure about “account restrictions”
• Website domain looks unrelated to Bank of America
• Unexpected request to install software for a banking account
• Downloaded ZIP/VBS file from a website link
• Banking pages hosted on unrelated domains