Researchers found a real campaign offering fake “desktop apps” for major U.S. payroll/HR platforms that don’t actually provide desktop software. Victims who install the download unknowingly install ScreenConnect remote access configured for silent, unattended control, giving attackers a direct path to payroll systems and company paychecks.
The operator behind this campaign built lure pages advertising desktop apps for three large US payroll and HR platforms, even though those platforms are delivered only as web applications accessed through a browser. Each page carried the brand's logo, product screenshots, and a live-chat widget to appear legitimate, with a download button leading to a file hosted on GitHub releases rather than the vendor's own site.
When the download runs, it first opens a genuine, Microsoft-signed .NET Desktop Runtime installer. While that installer finishes normally on screen, the installer quietly runs msiexec with the /qn flag in the background, which installs ScreenConnect with no visible interface. The victim only ever sees a legitimate-looking Microsoft installer complete, and the promised payroll app never appears because it never existed.
This attack relied on a gap between expectation and reality. Employees who work with payroll or HR platforms may reasonably assume a vendor could release a desktop app for convenience, so the pretext did not require urgency or fear, just plausibility. Showing a real, signed installer window removed the most obvious visual cue of compromise, since nothing on screen looked like malware while the silent installation happened underneath.
The infrastructure choices reinforced the illusion of legitimacy: lure pages built and hosted through mainstream web tools, a download hosted on a well-known code-sharing platform, and a live-chat widget that made the fake product pages feel like real vendor support channels.
Organizations should treat payroll and HR staff as high-value targets, since unattended remote access to those machines is described as a path to diverting or draining an entire company's payroll. Practical steps include:
This technique maps to MITRE ATT&CK techniques such as https://attack.mitre.org/techniques/T1656/ and https://attack.mitre.org/techniques/T1204/002/, both of which describe impersonation and user-driven execution as entry points for remote access tooling.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They advertised desktop apps for payroll and HR platforms that only exist as web applications, then hid a silent ScreenConnect installation behind a genuine Microsoft-signed runtime installer.
The installer opened a real, Microsoft-signed .NET Desktop Runtime installer on screen while running msiexec with the /qn flag in the background to install ScreenConnect with no visible interface.
People who run payroll are the most likely targets, since unattended remote access to their machine gives attackers a path toward diverting or draining company payroll.
Verify with the vendor before downloading anything, and treat any download the vendor does not officially offer as a red flag rather than an upgrade.
You see a slick site: your payroll system, big logo, and a button saying, “Download the desktop app for faster payroll processing.” Here’s the trick: these payroll platforms don’t even offer desktop apps. The download comes from a GitHub Releases link, and when you run it, a real Microsoft .NET Desktop Runtime installer pops up while ScreenConnect remote control hides in the background. On screen, everything looks normal. The installer finishes, no errors, but no payroll app ever opens, because it doesn’t exist. Instead, ScreenConnect phones home to a hidden server and gives silent, unattended access to your payroll machine. If your payroll or HR tool usually runs in a browser, here’s the move: never install a “new desktop app” from a website. Stop, and confirm with the vendor or IT before you download anything.
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Attackers impersonated LastPass on GitHub and tricked people searching for the “LastPass Authenticator download” into installing a fake installer. The infection chain used a Microsoft-signed driver to disable many security tools, then deployed an infostealer that stole passwords, crypto wallets,…
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
Researchers found attackers impersonating LastPass with a fake GitHub “LastPass Authenticator” download page that tricks people into downloading a large ZIP and running a fake installer. The installer uses a Microsoft-signed Windows driver to shut down antivirus/EDR tools, then runs a password…
Attackers used fake “LastPass Authenticator” and fake macOS LastPass pages on GitHub to trick people into downloading a malicious installer. The campaign relied on SEO so the fraudulent GitHub page appeared near the top of search results, then redirected victims through multiple pages to a download…
Researchers linked the Iran-aligned Handala Hack persona to a Telegram-controlled backdoor (HEAVYGRAM) that can steal passwords and exfiltrate chat data. The campaign reportedly starts with social engineering on messaging apps (Telegram, WhatsApp, Instagram), where the attacker pretends to offer…
