Listen to the episode
TLDR
Threat actors are running a phishing campaign that abuses the legitimate Faronics Deploy endpoint management platform to enroll victim computers and push ConnectWise ScreenConnect, giving them hands on remote control. Emails disguised as...
How it works
Threat actors are running a phishing campaign that abuses the legitimate Faronics Deploy endpoint management platform to enroll victim computers and push ConnectWise ScreenConnect, giving them hands on remote control. Emails disguised as...
Red flags
- Unsolicited email with invoice/tax attachment pointing to an external download page, not your usual portal Browser prompt to download an 'Adobe Reader' or plugin update that is actually a Faronics Deploy installer ScreenConnect or Faronics agents installed on machines where IT never deployed them
What to do
- 1Verify any invoice or tax document by contacting the sender through a known phone number before opening links Audit endpoints for unexpected Faronics installations and review C:\ProgramData\Faronics\Logs\Scr
Source
bleepingcomputer
Source reviewed by Mythos Forensic Team
https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/FAQ
Is Phishing abuses Faronics Deploy to silently install ScreenConnect remote access on victim PCs a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Unsolicited email with invoice/tax attachment pointing to an external download page, not your usual portal Browser prompt to download an 'Adobe Reader' or plugin update that is actually a Faronics Deploy installer ScreenConnect or Faronics agents installed on machines where IT never deployed them
What should I do first?
Verify any invoice or tax document by contacting the sender through a known phone number before opening links Audit endpoints for unexpected Faronics installations and review C:\ProgramData\Faronics\Logs\Scr
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.