Fake payroll installers quietly deploy remote-control tool
Allure Security found an attacker offering fake desktop applications for three large US payroll and HR platforms that only provide browser-based products. Running the installer deploys ScreenConnect, a legitimate remote access tool configured to give the attacker hidden control of the machine. The lure pages were built with Lovable, hosted on Vercel behind a bot challenge, and linked to a GitHub-hosted installer that runs a genuine Microsoft .NET Desktop Runtime installer before silently installing ScreenConnect via msiexec.
Allure Security traced the campaign to a single operator: three fake payroll/HR desktop-app pages shared one LiveChat account, one GitHub account, and one ScreenConnect server in Germany. The pages were generated with Lovable, saved as static HTML via SavePage WE, and placed on Vercel behind a bot challenge, limiting scanner visibility.
The roughly 64 MB NSIS installer first launches Microsoft’s signed .NET Desktop Runtime 8.0.26, then uses msiexec /qn to install ScreenConnect silently. The remote tool is set for unattended access, hides its tray icon and notifications, runs as a service, and can load at sign-in. GitHub downloads reached 291; 32 of 70 engines flagged it.
Payroll and HR staff, finance teams, and their employers could be most affected if such fake installers succeed. Hidden remote access may let an attacker observe systems, alter payment details, or disrupt payroll, potentially affecting employees’ wages and sensitive data. Because the lure mimics trusted brands and uses a legitimate remote tool, it may also weaken confidence in ordinary software downloads and support workflows. Organizations may need stronger verification and endpoint monitoring.