Fake payroll desktop apps hand attackers a route to company paychecks
Overview
Researchers at Allure Security have discovered a malicious scheme where attackers are distributing fake desktop applications claiming to be for three major US payroll and HR platforms. These platforms do not actually offer desktop versions, as all their services are web-based. When users install these fraudulent apps, they inadvertently install ScreenConnect, a legitimate remote access tool that is configured for unauthorized access by the attacker. This means the attacker can control the user's computer without their knowledge, potentially leading to theft of sensitive payroll information. Companies and employees need to be cautious about downloading software that purports to be from trusted vendors and stick to official sources for applications.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: US payroll and HR platforms (specific vendors not named)
- Action Required: Users should avoid downloading software from unofficial sources and verify any application through the official website of the vendor.
- Timeline: Newly disclosed
Original Article Summary
An attacker has been offering “desktop apps” for three large US payroll and HR platforms that have never released one, Allure Security have found. Anyone who runs the installer gets a copy of ScreenConnect, a legitimate remote access tool, configured to let the attacker control the computer without the user knowing. According to Ryan Merritt, Director of Security Research at Allure Security, all three providers deliver their products as web applications accessed through a browser, … More → The post Fake payroll desktop apps hand attackers a route to company paychecks appeared first on Help Net Security.
Impact
US payroll and HR platforms (specific vendors not named)
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Newly disclosed
Remediation
Users should avoid downloading software from unofficial sources and verify any application through the official website of the vendor.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Malware.